整理[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

整理.exe
Size

47KB
MD5

f8209c20c729c1894c059ab6145289db
SHA1

f7bee06eb6bf3daf3711b018844bea97c6179480
SHA256

42169e94c11cc22a9011fa567e35467177969acd298f36d04e14e53b6c5e1ac6
SHA512

fad4541df1379bf7a2a713299f7f4e37bd62d586b1a46efebdf8b68e490c7406ab0841f30b9cc08c25c65930e01262fedc08881f92335aaa32ed5f724e153fb6
SSDEEP

384:T4XTTeYkseGf9T44dAkMQfQHbrgG/cQ6i+B867rFgWMEMRQfPxVwHqZxZrF8EQF2:kX9kz2t7kf/fIrFg9TCyKFHLz+Z2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
整理.exe

Files

整理.exe
.exe windows:4 windows x86 arch:x86

bbe06459abbb1d845c350bfe00379c91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pbvm90

ord137

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCPInfo
IsDBCSLeadByte
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
GetACP
GetOEMCP
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
RtlUnwind
VirtualFree
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
LoadLibraryA
WriteFile
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
VirtualAlloc
GetProcAddress

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ