run[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

run.exe
Size

11.4MB
MD5

29de28efab6e5238b53be6fcdab8ecd9
SHA1

b733461008bb97d9d766c3165791ebe3bdd89ab7
SHA256

72e0fcfa4cf6766f88df74da16a71ac04e78f6219804037d9d3f1639a81ed066
SHA512

2683221a7ad3e4b07faf2bdb8efec6713090df52686062bbaf26f39440f64606d8ee8eb54c65dc391e3f082c8882caf28b28ed7912e8508506236378999fddfc
SSDEEP

196608:I76VFNiyOAOmz8gTJccTg5Cp00Y/sTkV2mJp+cgbQpzGYH++/MxCwXgDAdR:IIF7OkDJbg5CjY/sIA6pdgIq/+wh5R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
run.exe

Files

run.exe
.exe windows:5 windows x86 arch:x86

724aa6f71a1e8da9d9ee87cb798e8df2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
lstrcmpiW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
lstrcpyW
GetComputerNameA
Process32FirstW
DeviceIoControl
GetProcAddress
LoadLibraryA
UpdateResourceW
TerminateProcess
Sleep
OpenProcess
QueryFullProcessImageNameW
WaitForSingleObject
GetCurrentProcess
CreateProcessW
GetCommandLineW
LockResource
GetLastError
SizeofResource
GetStringTypeW
LoadResource
CreateFileW
FindResourceW
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
MultiByteToWideChar
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
DeleteCriticalSection
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
LoadLibraryW
SetStdHandle
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
FlushFileBuffers
HeapSize
HeapReAlloc
SetEndOfFile
GetProcessHeap
LCMapStringW

user32

wsprintfW

advapi32

LookupPrivilegeValueW
CloseServiceHandle
AdjustTokenPrivileges
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
OpenSCManagerW
DeleteService
OpenProcessToken

shell32

CommandLineToArgvW

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

724aa6f71a1e8da9d9ee87cb798e8df2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

crypt32

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 11.3MB - Virtual size: 11.3MB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 11.3MB - Virtual size: 11.3MB

.reloc
Size: 4KB - Virtual size: 3KB