A[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

A.exe
Size

67KB
MD5

77dc8c8d485530aecd371723889c4535
SHA1

41494959d2b29b6ed31c889a1cd9462ab0d1174a
SHA256

5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726
SHA512

d019ac56c0b6aba76e4a5612a470afbb9f66fd1cb74c0f76e3641549178f4d4e0d44ac489a6515c6b1117ff4018b37d0d227263e21ca4b94b571ed0d5e7946f6
SSDEEP

1536:70w2+nzaBwQjs/7GD2CthAo6WJbEZPjwA9gkqBQa:7OhwQY/02QAxWe179gkAQa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
A.exe

Files

A.exe
.exe windows:5 windows x86 arch:x86

ecc488e51fbb2e01a7aac2b35d5f10bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
EnterCriticalSection
lstrlenW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
FindClose
GetLastError
TerminateThread
WideCharToMultiByte
ExitProcess
lstrcatW
lstrcpyW
LocalFree
HeapFree
SetLastError
HeapAlloc
GetProcessHeap

user32

CharLowerW

shlwapi

StrCmpNIW
StrCpyNW

ws2_32

htons
WSAGetLastError

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ