cksum[.]exe | Triage

Sharing

General

Target

cksum.exe
Size

22KB
MD5

6f59e17951703d3390c3fe6b43554865
SHA1

675092e33770e88f9cd64262ba28699d0cedfffa
SHA256

18d782eeb0f2b41ed6c5c25d58cabac7ce12ec11e9df636e43ade9f8a25db0f4
SHA512

bc40556cf10ec2c1ec0462cf1346b3799f5cd2b7329d8e96913f86b08dc758e08227f3e52831ceaf8f604eb6ad0ad3b66e14d7acad1d58bfbb8d2608e1819c16
SSDEEP

384:ps2n1PCzfHIF4vRO+Qoza7RRe5S9NydaAjh1TRbKOwQhyPhyqV/YRkZwG:p1GROiAoU9NywGPRKOUPhyqV/Yo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cksum.exe

Files

cksum.exe
.exe windows:4 windows x86 arch:x86

2cce12650af0d66f8a988ff3dc802f67

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
atexit
calloc
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fopen
fputs
fread
free
getenv
malloc
memcpy
memset
putc
realloc
setlocale
strchr
strcmp
strerror
strlen
strncmp
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 556B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE