getmac[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

getmac.exe
Size

63KB
MD5

1f4b47509e3b2bf4ae9e6eba191cf3e9
SHA1

d18125df129262045a4f642caa880556ceb6a3bc
SHA256

83a26a068e174e389b9793e93e65b802b6d923cc70ee8afb06b49c885491b462
SHA512

c87bf1fde6660a627f4f15eb340c118b47c2b43c2f80f8487f8299688bab01b67fee097a502729f48ec046aec9096bd5839f8d26b97c6ef7f5d269582c58e302
SSDEEP

1536:Aq4azRifXs7Si9IOzIlEzYNgrscLvQipeSJHAFT0UaPH9:ALfXsei2OMUYerscbQiop0Ua/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
getmac.exe

Files

getmac.exe
.exe windows:10 windows x86 arch:x86

5ad2d88c0bf8cbfefaec540d70672c23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

getmac.pdb

Imports

msvcrt

fflush
fprintf
_CxxThrowException
memcpy
_get_osfhandle
_controlfp
_fileno
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
malloc
wcstoul
wcstol
wcstod
_errno
_vsnwprintf
_memicmp
free
__iob_func
wcstok
_except_handler4_common
wcsstr
_wcsicmp
__CxxFrameHandler3
memset

oleaut32

SysAllocStringByteLen
SysFreeString
SysStringLen
VariantInit
VariantClear
VariantChangeType
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SysAllocString

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

sspicli

GetUserNameExW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleMode
ReadConsoleW
WriteConsoleW
GetConsoleMode

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoTaskMemAlloc
CoUninitialize

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadUILanguage

wkscli

NetWkstaTransportEnum

netutils

NetApiBufferFree

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadStringW
GetModuleFileNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount

user32

wsprintfW

ntdll

RtlVerifyVersionInfo
VerSetConditionMask

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetLastErrorW

ws2_32

WSACleanup
GetAddrInfoW
GetNameInfoW
FreeAddrInfoW
WSAStartup
WSAGetLastError

framedynos

?Mid@CHString@@QBE?AV1@HH@Z
?Empty@CHString@@QAEXXZ
?SetAt@CHString@@QAEXHG@Z
??1CHString@@QAE@XZ
??YCHString@@QAEABV0@PBG@Z
?Left@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@PBG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Find@CHString@@QBEHG@Z
??4CHString@@QAEABV0@ABV0@@Z
?Mid@CHString@@QBE?AV1@H@Z
?GetData@CHString@@IBEPAUCHStringData@@XZ
??0CHString@@QAE@PBG@Z
?Compare@CHString@@QBEHPBG@Z
??0CHString@@QAE@XZ
?GetBufferSetLength@CHString@@QAEPAGH@Z
?ReleaseBuffer@CHString@@QAEXH@Z
?Format@CHString@@QAAXPBGZZ

srvcli

NetServerGetInfo

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW
StrStrW
StrChrIW
StrStrIW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

ReadFile
GetFileType

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-heap-l1-1-0

HeapValidate
HeapSize
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ad2d88c0bf8cbfefaec540d70672c23

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-errorhandling-l1-1-0

sspicli

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

wkscli

netutils

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

user32

ntdll

mpr

ws2_32

framedynos

srvcli

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-datetime-l1-1-0

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 3KB