SKIDROW[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SKIDROW.exe
Size

34.5MB
MD5

a56de08479860233b0edb4d7e5dbf481
SHA1

953bb3fd7762dc1dbb0b420ddd81ff0009c464bf
SHA256

a1e067c356dc430a130b2a1cc6e28d2e200a7cfbf5d7d37ddfe5db4fbc15d649
SHA512

7b27a521f4d81ba3df7966a5c2521d68fd011daa3d723e84bfb55b7653ff5f77451c5ecd4c8316aab40e850ed8ef48eb858c12ea64bd94d32f4f88668237205b
SSDEEP

786432:nbr9TQ6SiBNCnqFrSU926fLLz21UgTSMjAmnBf/4u:n/BprCncrnc16MkQl4u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SKIDROW.exe

Files

SKIDROW.exe
.exe windows:4 windows x86 arch:x86

768d2a1c9fec6851632cce17641ec571

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
wcscmp
memmove
wcslen
wcscpy
wcscat
sprintf
malloc
free
_wstat
_wcsdup
strcmp
floor
ceil
wcsncmp
fabs
fseek
ftell
fread
memcpy
fclose
pow
??3@YAXPAX@Z
wcsncpy
_wcsicmp
tolower
calloc
_lseeki64
_errno
realloc
abort
_close
_wopen
_setmode
exit
_open_osfhandle
strchr
_strdup
_snprintf
setlocale
strrchr
strncmp
wctomb
_get_osfhandle
_open
toupper
wcschr
mbstowcs
_vsnwprintf

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
RemoveDirectoryW
FindResourceW
LoadResource
SizeofResource
GetCommandLineW
GetTempFileNameW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
CreateThread
TerminateThread
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
CreateProcessW
HeapFree
TerminateProcess
CreateFileW
GetFileSize
ReadFile
DeleteFileW
WriteFile
SetUnhandledExceptionFilter
Sleep
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
HeapReAlloc
TlsAlloc
MulDiv
SetFileAttributesW
MoveFileW
GetCurrentDirectoryW
GetDriveTypeW
FindFirstFileW
FindClose
GetFileAttributesW
GetTempPathW
CreateDirectoryW
SetFilePointer
SetEndOfFile
TlsFree
TlsGetValue
TlsSetValue
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetExitCodeProcess
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

user32

FindWindowW
GetWindowThreadProcessId
ShowWindow
SetWindowPos
SetForegroundWindow
LoadIconW
SendMessageW
IsWindow
GetWindowRect
ClientToScreen
GetSystemMetrics
MoveWindow
MessageBoxW
GetForegroundWindow
IsWindowVisible
GetWindowLongW
IsWindowEnabled
EnableWindow
EnumWindows
DestroyWindow
CreateWindowExW
SetWindowLongW
CallWindowProcW
RemovePropW
DefWindowProcW
GetPropW
GetParent
SetPropW
GetWindow
SetActiveWindow
DestroyIcon
LoadCursorW
RegisterClassW
AdjustWindowRectEx
CreateAcceleratorTableW
UnregisterClassW
SetTimer
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
GetAncestor
IsDialogMessageW
TranslateMessage
DispatchMessageW
IsZoomed
IsIconic
KillTimer
SetWindowTextW
DefFrameProcW
SetFocus
GetFocus
GetClientRect
FillRect
DestroyAcceleratorTable
SetRect
EnumChildWindows
PostMessageW
GetDC
ReleaseDC
GetKeyState
GetClassNameW
IsChild
RegisterWindowMessageW

gdi32

GetStockObject
DeleteObject
GetDeviceCaps
GetObjectW
CreateBitmap
CreateCompatibleDC
SelectObject
SetPixel
DeleteDC
CreateDIBSection
GetDIBits
BitBlt
GetObjectType
CreateDCW
CreateFontW

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx

ole32

CoInitialize
RevokeDragDrop

shell32

ShellExecuteExW

winmm

timeBeginPeriod

shlwapi

PathQuoteSpacesW
PathRemoveExtensionW
PathAddBackslashW

Sections

.code
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22.3MB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

768d2a1c9fec6851632cce17641ec571

Headers

File Characteristics

Imports

msvcrt

kernel32

gdiplus

user32

gdi32

advapi32

comctl32

ole32

shell32

winmm

shlwapi

Sections

.code Size: 7KB - Virtual size: 7KB

.text Size: 262KB - Virtual size: 262KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 11KB - Virtual size: 13KB

.rsrc Size: 22.3MB - Virtual size: 22.3MB

.code
Size: 7KB - Virtual size: 7KB

.text
Size: 262KB - Virtual size: 262KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 11KB - Virtual size: 13KB

.rsrc
Size: 22.3MB - Virtual size: 22.3MB