dircolors[.]exe | Triage

Sharing

General

Target

dircolors.exe
Size

28KB
MD5

c13ff5b3684607a0401ec4233819a93e
SHA1

795d66d3792eb5215ab266fee34ffb5f2054e927
SHA256

b68c2330d79ef45823ea6bffa6ba5bec0c4142abc094dce0fee85b70698a7043
SHA512

bbb2bb2b594ca5df58a66297590b9862fdbbfa0894617c057fae9a4afb9b02805cda5e8ca5b803e86cf7119a77333d443a3105d51a00fbe94d41e661d41bd681
SSDEEP

384:Ut4eh+daEzUOIBULbUMzHMUozajp004QgQp9BgdaAjhEvI2EIuTc12t6OQQhyPhq:FHo/B6p9BgwG6v9yc12t6O0PhyqVuJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dircolors.exe

Files

dircolors.exe
.exe windows:4 windows x86 arch:x86

a4c52f26d5b64f72eb1a65faae63d6ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
atexit
calloc
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fputs
free
freopen
fwrite
getc
getenv
malloc
memchr
memcpy
memset
putc
puts
realloc
setlocale
strchr
strcmp
strerror
strlen
strncmp
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 588B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE