ct_run[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ct_run.exe
Size

25KB
MD5

e212c563b4ceafb352cc84cb45f22881
SHA1

a30da4cb66ab3f526ddb5f5518553932e9da37f7
SHA256

943c5bff3fbd3b43ae1fd065ea01a2a885e290321ea75b4a7cab3b30d5084ea4
SHA512

c43e567385ac27796ea61a78838bbcb4449b2a79187b959bfa1f89ee6901281078ae30d6e71098fc13aec33d08316b54f728c15483de28e569637389d7e8d201
SSDEEP

384:oW6OtHB05lebE1R29vncXs8wOKv/47PpuZWatWwrHCav0kJTM+Es/OLivwFc3TAd:oamAEovnLnzZagmOQ+8RFuA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ct_run.exe

Files

ct_run.exe
.exe windows:5 windows x64 arch:x64

e395f67226b2218ac66bb54d8101b153

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\ldisk\daily_build\18_opu_c.2015-09-22_21\otp_src_18\bin\win32\ct_run.pdb

Imports

msvcr100

_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__winitenv
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
isdigit
log10
sprintf
free
memcpy
fwrite
putc
_errno
strncpy
memset
realloc
printf
isspace
_waccess
malloc
__iob_func
fprintf
__set_app_type
exit
_write
_fileno

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
Sleep
WideCharToMultiByte
GetLastError
GetStdHandle
CreateProcessW
CloseHandle
WaitForSingleObject
GetExitCodeProcess
MultiByteToWideChar
GetSystemTimeAsFileTime

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e395f67226b2218ac66bb54d8101b153

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 924B

.rsrc Size: 1024B - Virtual size: 764B

.reloc Size: 512B - Virtual size: 60B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 924B

.rsrc
Size: 1024B - Virtual size: 764B

.reloc
Size: 512B - Virtual size: 60B