measure[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

measure.exe
Size

644KB
MD5

3e51b90ffd24068f364450f2256efc0d
SHA1

134775f1a540889fe5e79e7622d099b40f73d1ca
SHA256

42915f6b6d0bc99c01d8f7db101f255ae1b8f2ba4f151d82fc0cbc73dad89b69
SHA512

7debc2e1112be1bf267d244a4635e3017ad2cf5234916f270b484f9b6c50a423b9af41ecf59aa7cd2c28d11571d9215015db21b548c9ed57911fe936aa057fed
SSDEEP

6144:s5BXbkt9kkJmVUNMRyFgjQFb//q0hlC/lb8dTinnF5vV8CSx4DOALG+L0XG:4Vy9kmmAgYicTirtXV0G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
measure.exe

Files

measure.exe
.exe windows:6 windows x64 arch:x64

e4f6024fd55e041495431114dcb268f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

measure.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

ntdll

NtQuerySystemInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlGetVersion
RtlNtStatusToDosError
NtReadFile
NtQueryInformationProcess
NtWriteFile

advapi32

CopySid
GetLengthSid
IsValidSid
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

dbghelp

SymCleanup
SymFromAddrW
SymInitializeW

kernel32

CreateThread
WriteConsoleW
GetFullPathNameW
GetModuleHandleA
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
CloseHandle
GetLastError
GetCurrentThreadId
GetThreadId
GetCurrentProcessId
GetProcessId
SuspendThread
GetThreadContext
ResumeThread
ReadProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
Thread32First
Thread32Next
OpenThread
GetThreadTimes
OpenProcess
GetCurrentProcess
IsWow64Process
Wow64GetThreadContext
GetTickCount
GetSystemInfo
GetProcessHeap
HeapFree
HeapAlloc
LocalFree
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
GlobalMemoryStatusEx
K32GetPerformanceInfo
CreateFileW
LoadLibraryExA
GetProcAddress
FreeLibrary
WaitForSingleObject
FormatMessageW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
Sleep
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
GetStdHandle
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetConsoleMode
GetModuleHandleW
GetModuleFileNameW
IsProcessorFeaturePresent

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

pdh

PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCollectQueryData

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

vcruntime140

memset
__current_exception
_CxxThrowException
__C_specific_handler
__current_exception_context
memcmp
memmove
memcpy
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

floor
pow
__setusermatherr
round
log2

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
_set_app_type
_seh_filter_exe
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
__p___argc
_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4f6024fd55e041495431114dcb268f3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

dbghelp

kernel32

psapi

pdh

powrprof

shell32

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 466KB - Virtual size: 465KB

.rdata Size: 152KB - Virtual size: 151KB

.data Size: 512B - Virtual size: 904B

.pdata Size: 22KB - Virtual size: 22KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 466KB - Virtual size: 465KB

.rdata
Size: 152KB - Virtual size: 151KB

.data
Size: 512B - Virtual size: 904B

.pdata
Size: 22KB - Virtual size: 22KB

.reloc
Size: 2KB - Virtual size: 2KB