htdbm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

htdbm.exe
Size

76KB
MD5

fe3bc5124adc6529a6aae95d82e2b7bf
SHA1

915a10d2734fc83fbc0fc116a5d825f3b360abbb
SHA256

6f28d52126c3999c290cf62b39b0fe05d881845643cefe10b384ce06e4828571
SHA512

f25fc3f5f3efd61f998960fb7b0b03f107546d2f49659b5947f22f3a8b4bc07d3cc8f53a161a3f1830484f98dc982a38a55ccf101a12eeb11dc701e1687883af
SSDEEP

1536:DF19X10kPlBEjA4I0wYEBDaSOFfJIcNE8QsbdqV6:PRNtBSbwfO3IcNE8Qs86

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
htdbm.exe

Files

htdbm.exe
.exe windows:4 windows x86 arch:x86

f6f6c080cc347aebf141f8ae9460f431

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
bsearch
tolower
strncat
wcsncmp
memmove
toupper
wcscpy
atoi
wcslen
_ftol
modf
strncmp
realloc
__p__environ
malloc
__p__wenviron
free
strerror
_errno
memchr
fputs
_getch
fputc
__mb_cur_max
fprintf
_iob
signal
strncpy
strchr
rand
srand
time
_pctype
_isctype
_strnicmp
_stricmp
exit

kernel32

LoadLibraryExA
LoadLibraryExW
SetErrorMode
FreeLibrary
GetEnvironmentVariableA
GetEnvironmentVariableW
UnlockFileEx
UnlockFile
LockFileEx
LockFile
FindFirstFileW
FindClose
FindFirstFileA
GetFileInformationByHandle
GetFileType
LocalFree
PeekNamedPipe
ReadFile
GetOverlappedResult
GetFullPathNameW
GetFullPathNameA
GetDriveTypeW
GetDriveTypeA
SetLastError
CreateFileW
SetFilePointer
FormatMessageA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GlobalFree
GetCommandLineW
TlsAlloc
TlsFree
GetVersionExA
GetProcAddress
LoadLibraryA
LeaveCriticalSection
WriteFile
EnterCriticalSection
InitializeCriticalSection
CreateFileA
CloseHandle
GetLastError
DeleteCriticalSection
GetStdHandle
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
CreateMutexA
CreateEventA
ReleaseMutex
SetEvent
GetSystemTimeAsFileTime
Sleep
SetStdHandle

advapi32

AllocateAndInitializeSid
FreeSid

wsock32

ntohl
WSAStartup
WSACleanup

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6f6c080cc347aebf141f8ae9460f431

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

wsock32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB