hostname[.]exe | Triage

Sharing

General

Target

hostname.exe
Size

20KB
MD5

d5932741c48769745517c36f0ac4f11e
SHA1

1f2e3ef077ab8e6881807a0a238ffdb4a5518397
SHA256

c84dfc01ca5db3fded0e59288096892939489345738f58401e8f89b76c886035
SHA512

7fc2dfd0043d641421cd940e202dd34dd857ef7dbe84587b66e1e2273c1f3a5f8ce285949da3394ae164d35c289ae098b6762971ca7a5fc1a2fb39eaf51ad2ec
SSDEEP

384:blK4qzMlISTt+7hl5/oza2L6TqbkUAqyda4T5AEOk9zQhyPhyqVrkhwG:G7hl5YhGTWkKywutOKlPhyqVe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hostname.exe

Files

hostname.exe
.exe windows:4 windows x86 arch:x86

cd996d24f7a442c4ad9620db5df6765e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
atexit
calloc
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fputs
free
getenv
gethostname
malloc
memcpy
memset
putc
realloc
setlocale
strchr
strcmp
strerror
strlen
strncmp
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 540B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE