crtinst[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crtinst.exe
Size

3KB
MD5

d40978939c9e24a48483c6436352396e
SHA1

1e121fb191aacae60972673b78505ae9230b10a3
SHA256

d8c81de99c12bfaf736fcb7ed780aaed6e31b3e93ce579010b1824e20bc2bb57
SHA512

1c2b51c81eb470a147480792d189b391626fe52ce1d84c8178b00ca9942e5f8726b4b58473307e0e800c0d9528772e10a890a29fbdd99f9e00263f8d4a99458f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crtinst.exe

Files

crtinst.exe
.exe windows:5 windows x86 arch:x86

21e2fced02e32ceb459a56d03aa7503e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
FreeLibrary
CreateProcessW
WaitForSingleObject
OutputDebugStringW
LoadLibraryW
lstrcmpW
GetLastError
lstrcatW
LocalFree
lstrcpyW

user32

wsprintfW

shell32

CommandLineToArgvW

Sections

.text
Size: 512B - Virtual size: 507B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 582B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ