comm[.]exe | Triage

Sharing

General

Target

comm.exe
Size

22KB
MD5

6a9d0801d72e448caf68860b8eea9fc6
SHA1

35cc255830d07a2c4cc17b3ddbae4c365a479ee1
SHA256

e07dc02866e7d0f7ec8e066ae0f53865292d37949c71b47101a29295283b39fa
SHA512

c49da505199939fd88a82db0f9c4e67586ecd7ebc15f9892fd84483b1060918bbf04cf60bd9c5ed625a3e92c061e58f6707333f8f25b552da889287fd6b025ce
SSDEEP

384:3Ju+N/TYkz20I+e4he1sB/E7he8ozaG93mCXedaQjxDqOqQhyPhyqV2VshwG:kWh5BcletD2CXewWcOOPhyqVJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
comm.exe

Files

comm.exe
.exe windows:4 windows x86 arch:x86

26d52092eeb2a7122f0c3852108fba5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
atexit
calloc
close
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fcntl
fdopen
fflush
fileno
fopen
fputs
free
fwrite
getc
getenv
malloc
memcpy
memset
putc
realloc
setlocale
strchr
strcmp
strcoll
strdup
strerror
strlen
strncmp
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 604B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE