imhex[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

imhex.exe
Size

1.9MB
MD5

78558b37a621ec2702c3c054ff15cc8a
SHA1

cde9b6c179fa3c56c9c9ee1ac4661c1be3d27b44
SHA256

d9cc8592e61fa64de50a200ff4814656b772cba018dbd7d9876ce89766453d11
SHA512

3bfdef367652d893c99f7028ec3826336c4d862b0239e3841e336a3d471323de10d8c2e7877f417d99cc69349ad0f0390706a2a319f5b4d389ed5e21b7e60b99
SSDEEP

24576:SBEn8xOqkk7DSwOB13xj5MTs+pg8VlYpva+KB3I:SB0rk7DSwOB13xjl+pg8rYpvdKB3I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
imhex.exe

Files

imhex.exe
.exe windows:6 windows x64 arch:x64

28711b060895778e1602672ab8202166

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Imports

libgcc_s_seh-1

_Unwind_Resume
__udivti3

kernel32

CloseHandle
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
FreeConsole
GetCommandLineW
GetConsoleMode
GetConsoleWindow
GetCurrentProcessId
GetLastError
GetModuleFileNameW
GetShortPathNameW
GetStdHandle
InitializeCriticalSection
LeaveCriticalSection
SetConsoleMode
SetEnvironmentVariableA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
__C_specific_handler

msvcrt

__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
isspace
malloc
memchr
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf

libstdc++-6

_ZNKSt10filesystem7__cxx114path11parent_pathEv
_ZNKSt10filesystem7__cxx114path5_List13_Impl_deleterclEPNS2_5_ImplE
_ZNKSt13runtime_error4whatEv
_ZNKSt25__codecvt_utf8_utf16_baseIwE10do_unshiftERiPcS2_RS2_
_ZNKSt25__codecvt_utf8_utf16_baseIwE11do_encodingEv
_ZNKSt25__codecvt_utf8_utf16_baseIwE13do_max_lengthEv
_ZNKSt25__codecvt_utf8_utf16_baseIwE16do_always_noconvEv
_ZNKSt25__codecvt_utf8_utf16_baseIwE5do_inERiPKcS3_RS3_PwS5_RS5_
_ZNKSt25__codecvt_utf8_utf16_baseIwE6do_outERiPKwS3_RS3_PcS5_RS5_
_ZNKSt25__codecvt_utf8_utf16_baseIwE9do_lengthERiPKcS3_y
_ZNKSt6locale2id5_M_idEv
_ZNSt10filesystem7__cxx1116filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt10error_code
_ZNSt10filesystem7__cxx1116filesystem_errorD1Ev
_ZNSt10filesystem7__cxx114path14_M_split_cmptsEv
_ZNSt10filesystem7__cxx114path5_ListC1ERKS2_
_ZNSt10filesystem7__cxx114path5_ListC1Ev
_ZNSt10filesystem7__cxx114pathdVERKS1_
_ZNSt13runtime_errorC2EPKc
_ZNSt13runtime_errorD2Ev
_ZNSt25__codecvt_utf8_utf16_baseIwED2Ev
_ZNSt3_V215system_categoryEv
_ZNSt3_V216generic_categoryEv
_ZNSt6locale5facetD2Ev
_ZNSt6localeC1ERKS_
_ZNSt6localeC1Ev
_ZNSt6localeD1Ev
_ZNSt7__cxx118numpunctIcE2idE
_ZNSt7codecvtIwciEC2Ey
_ZSt16__throw_bad_castv
_ZSt17__throw_bad_allocv
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt28__throw_bad_array_new_lengthv
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdlPvy
_Znwy
__cxa_allocate_exception
__cxa_free_exception
__cxa_throw
__dynamic_cast
__gxx_personality_seh0

user32

GetWindowThreadProcessId
MessageBoxA

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/18
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/33
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/58
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/86
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/118
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28711b060895778e1602672ab8202166

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libgcc_s_seh-1

kernel32

msvcrt

libstdc++-6

user32

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 19KB - Virtual size: 18KB

.buildid Size: 512B - Virtual size: 53B

.data Size: 512B - Virtual size: 560B

.pdata Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 124KB - Virtual size: 123KB

.reloc Size: 512B - Virtual size: 304B

/4 Size: 19KB - Virtual size: 18KB

/18 Size: 3KB - Virtual size: 2KB

/33 Size: 3KB - Virtual size: 3KB

/46 Size: 1.1MB - Virtual size: 1.1MB

/58 Size: 119KB - Virtual size: 118KB

/70 Size: 9KB - Virtual size: 8KB

/86 Size: 307KB - Virtual size: 306KB

/102 Size: 46KB - Virtual size: 46KB

/118 Size: 18KB - Virtual size: 17KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 19KB - Virtual size: 18KB

.buildid
Size: 512B - Virtual size: 53B

.data
Size: 512B - Virtual size: 560B

.pdata
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 124KB - Virtual size: 123KB

.reloc
Size: 512B - Virtual size: 304B

/4
Size: 19KB - Virtual size: 18KB

/18
Size: 3KB - Virtual size: 2KB

/33
Size: 3KB - Virtual size: 3KB

/46
Size: 1.1MB - Virtual size: 1.1MB

/58
Size: 119KB - Virtual size: 118KB

/70
Size: 9KB - Virtual size: 8KB

/86
Size: 307KB - Virtual size: 306KB

/102
Size: 46KB - Virtual size: 46KB

/118
Size: 18KB - Virtual size: 17KB