a[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

a.exe
Size

2.3MB
MD5

ee9a10cc6bd9f7796059ae02ba639f1e
SHA1

23747dee593504e58b971aebe0c141ec6c731f06
SHA256

9e1dffbe4c8972181a53065138ee824127dcef0f9b86d3053f496e1ddb4f4144
SHA512

0ae1239ea582fb113e7598005835c40327dab40f4e4c72c2b18c1344cba32adc769d18f719c4ce92a2be6c9875379ca1c3f493c44c7a799f8078aff7ccf0efdc
SSDEEP

49152:DI10S/UlnJt37NunQ7Djx4Z1OeAps9EWwPgTRNMWhJve8IWye3bJAsjrXh1:DI10blJuGuZgeAp9WjNp5e1Wye3bO8Dz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a.exe

Files

a.exe
.exe windows:5 windows x86 arch:x86

0b72ebf001b7a4954faf069e98dd37cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Workplace\新建文件夹\FileBindTool\Release\2.pdb

Imports

kernel32

GetModuleFileNameW
GetShortPathNameW
GetEnvironmentVariableW
lstrcpyW
lstrcatW
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetModuleHandleW
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
CreateFileW
CloseHandle
GetLastError
GetVersionExW
LoadLibraryA
GetTempPathA
GetTempFileNameA
CopyFileA
SetFilePointer
ExitProcess
Process32FirstW
lstrcmpiW
ReadFile
GetTempPathW
WriteFile
CopyFileW
DeleteFileW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
IsValidCodePage
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MoveFileA
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapCreate
Sleep
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP

user32

GetWindow
SendMessageW
GetClassNameW
IsWindow
GetTopWindow

shell32

ShellExecuteW
SHChangeNotify
ShellExecuteExW

shlwapi

PathRemoveFileSpecW

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b72ebf001b7a4954faf069e98dd37cf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

shlwapi

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 6KB - Virtual size: 6KB