bad_prank[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

bad_prank.exe
Size

282KB
MD5

334b1b9a7780c96021fd28410fc4b47c
SHA1

4f2a60ed46e258ccc4f00413e3fa4781e2a83bfa
SHA256

0dedf4bd62c44017f5b78fa8c501dd7b6f19b5b48279bb5ec90d9189d046b2bd
SHA512

9a7c88c3436f404965af3813ad1478c7b72de996884fa3870a5c2997eae75248572dd940217606d61fa7cc953616eb3bf7a0e932c42c9bb26cdc8a6315693987
SSDEEP

6144:r4jejaVCvYXNd5aEjCM+BgGI9BMIPUY/MxQelS:r4jDYvYXX5pQgbLMIDqnS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad_prank.exe

Files

bad_prank.exe
.exe windows:6 windows x64 arch:x64

e3859dbc894fde0137d05d87bda5f264

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\alber\projects\prank\target\debug\deps\prank.pdb

Imports

kernel32

GetCurrentProcessId
DuplicateHandle
WriteFileEx
SleepEx
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
GetModuleHandleA
GetProcAddress
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
InitializeSListHead
FindFirstFileW
GetStdHandle
UnhandledExceptionFilter
GetCurrentThreadId
GetConsoleMode
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentDirectoryW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
SetLastError
RtlLookupFunctionEntry
RtlVirtualUnwind
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
AcquireSRWLockExclusive
QueryPerformanceCounter
IsDebuggerPresent
WaitForSingleObject
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
ReleaseSRWLockExclusive
GetCurrentProcess
SetUnhandledExceptionFilter
FindClose
CloseHandle
IsProcessorFeaturePresent

advapi32

SystemFunction036
RegCloseKey
RegCreateKeyExW
RegSetValueExW

ntdll

RtlNtStatusToDosError
NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140

memcmp
memmove
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memcpy
__CxxFrameHandler3
memset

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_seh_filter_exe
_set_app_type
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3859dbc894fde0137d05d87bda5f264

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 61KB - Virtual size: 60KB

.data Size: 512B - Virtual size: 888B

.pdata Size: 10KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 61KB - Virtual size: 60KB

.data
Size: 512B - Virtual size: 888B

.pdata
Size: 10KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB