id[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

id.exe
Size

23KB
MD5

0375f82bffb7b32f16854da5f4128597
SHA1

5b92fd323568db3665f6a8705d18345643da3f0a
SHA256

dc9f32c726048e0a34ac33a0a094e7d8fc3d744116dd561c04232a3057676a96
SHA512

05e7cb0763e34ebc18015a2f04abe55e23717344a560de393698e221306d3498e63cfcecd274f03c1562520d5d0f8bfb0f9a583c102f57fa0a110d88a02afe4d
SSDEEP

384:O9BHDhc3d2SzMlISTluSQLM2B0iD78jozaYYJFmoda4T5wCf/3KmOuQhyPhyqVlG:3rLM2Bh71EJsowuSADOiPhyqVA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
id.exe

Files

id.exe
.exe windows:4 windows x86 arch:x86

3d2fb0d10d3f0ecba8fa0d5869408085

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
atexit
calloc
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
endgrent
exit
fclose
fflush
fputs
free
getegid
getenv
geteuid
getgid
getgrent
getgrgid
getgroups
getpwnam
getpwuid
getuid
malloc
memcpy
memset
putc
realloc
setgrent
setlocale
strchr
strcmp
strerror
strlen
strncmp
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 620B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE