escript[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

escript.exe
Size

27KB
MD5

56e56a87d316b5d53dc050006a615889
SHA1

9f6f09a5108139885e98e63ec56d8c30a88c80ca
SHA256

2437be1436477980b353b409a14864689e7f572f7819ca665c6875e644191869
SHA512

c364922c9337dd874d66e32bdcfeb752d805a7db687e8b1caa55128803a542196a4b8283af8ed682d1c497f3acdb62735e40b57c964b73012a4d35f369d53171
SSDEEP

384:TJNGposIH1ZRE7JqX2bDGMcZg48OXRr42Di82IegWatW8rWWlnNrrf/Q2IJXrLp8:SpPSqw2CB3hTaSNrzQ2kYL3rV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
escript.exe

Files

escript.exe
.exe windows:5 windows x64 arch:x64

ce8a013bf4fe9362d5f98603ea570274

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\ldisk\daily_build\18_opu_c.2015-09-22_21\otp_src_18\bin\win32\escript.pdb

Imports

msvcr100

_cexit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_exit
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
isdigit
log10
sprintf
memcpy
fwrite
putc
_errno
_stricmp
strncpy
memset
realloc
printf
isspace
_wfopen
fgets
fclose
wcsstr
wcsncpy
_waccess
free
malloc
__iob_func
fprintf
exit
_fmode
_vswprintf_c_l
_write
_fileno

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
Sleep
GetStdHandle
CreateProcessW
CloseHandle
WaitForSingleObject
GetExitCodeProcess
FindFirstFileW
FindClose
GetFullPathNameW
SetLastError
GetEnvironmentVariableW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce8a013bf4fe9362d5f98603ea570274

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 764B

.reloc Size: 512B - Virtual size: 60B

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 764B

.reloc
Size: 512B - Virtual size: 60B