ssr_find-x64[.]exe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ssr_find-x64.exe.exe
Size

3.3MB
MD5

6d6694f382a05174af6f43960f7ea37e
SHA1

dfcbb6245a38d3dc901601e37e0f6627af5573d5
SHA256

70e4dfe376a53683b46c76d25ce5d014b96f692ffe1bcb047ea9d40e345a4201
SHA512

aa5edd1f17e803924fa331bf4c6d67b97562890255b4f01c91cd906a4281ebbd3c290d7c23d55414fb49974f5c742b20fac025a2c69e6d1a550ce6425813e998
SSDEEP

98304:00qQGEKlXrMAvn+ktcl8wMCXX0eP0zdI0mL:03fEYXr+81CH0ePZ0mL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ssr_find-x64.exe.exe

Files

ssr_find-x64.exe.exe
.exe windows:4 windows x64 arch:x64

e7d5dacc0da7481a9d9e940b4b83da49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\buildbot-pdk-slave\pdk-aswinx64\build\src\PerlApp\src\paperl514.pdb

Imports

comctl32

ord17

kernel32

FreeLibrary
SystemTimeToFileTime
SetFileTime
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
FindFirstFileA
GetLastError
GetProcAddress
EnterCriticalSection
FindClose
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
DeleteCriticalSection
CreateFileA
OutputDebugStringA
GetVersionExA
CloseHandle
GetFileInformationByHandle
GetTempPathA
FindResourceA
LoadResource
LockResource
SetLastError
VirtualProtect
VirtualFree
RtlDeleteFunctionTable
RtlAddFunctionTable
VirtualAlloc
MultiByteToWideChar
ExitThread
RtlLookupFunctionEntry
RtlVirtualUnwind
GetComputerNameA
GetShortPathNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext

user32

MessageBoxA

advapi32

GetUserNameA

msvcrt

strchr
fflush
atoi
_errno
strncpy
fgets
_environ
fread
rand
localtime
srand
isdigit
fwrite
toupper
time
atol
getenv
fclose
memmove
strrchr
memset
strcmp
memcpy
strcpy
strlen
wcscmp
memcmp
_rmdir
_chmod
_fileno
_putenv
_strdup
strstr
_getpid
_strnicmp
_unlink
_dup2
_mkdir
_stricmp
__dllonexit
_onexit
__C_specific_handler
_XcptFilter
_c_exit
_exit
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
vsprintf
perror
sprintf
fputc
abort
_iob
fprintf
malloc
free
_stat
fputs
fopen
calloc
_setjmp

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7d5dacc0da7481a9d9e940b4b83da49

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 5KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3.2MB - Virtual size: 3.2MB