diff3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

diff3.exe
Size

28KB
MD5

1ffbb69b72f2a1250c88cc6d41a57b28
SHA1

c94a3dd785b20d3b9ef0681516ab074ee7e3d820
SHA256

4b04ca9f69464a2439730176b9b9c7153e66a73b954dd6553d5f599497db63ad
SHA512

5548ed7cb2b1a09df474645003f9248bb81cfd2c2c03eb38e1e4970df67d54e0a46157e93d0aec3a4299fd7d3fbd5683d2d9c94eb868bcf040f7ddb84f3da921
SSDEEP

768:wucjFf8ApGEwWFtazcTfcbUeLKw2LwxOJPFVyq8ae:kFdQ1WFtazcTfc+w5Ov

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
diff3.exe

Files

diff3.exe
.exe windows:4 windows x86 arch:x86

d1ef0b52169beeae9be16601fb56d722

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_exit
abort
calloc
close
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
dup2
execvp
exit
fclose
fcntl
fflush
fputc
fputs
free
freopen
fstat
fwrite
getc
getenv
malloc
memcpy
memset
pipe
putc
raise
read
realloc
setlocale
signal
sprintf
stat
strchr
strcmp
strerror
strlen
strncmp
vfork
vsnprintf
waitpid
write

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 516B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE