perl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

perl.exe
Size

25KB
MD5

243638bc21f2fd9ce28c9ef2012d11f2
SHA1

0f81c6bbddb3fda11ef36d4e3ef1aae204e57597
SHA256

8a1d1fb89c208cb5d2766605f484c3a8dea58833a8cb6e5942740f541321c93d
SHA512

3426c10fc09f84406e93b0006bbc59a030de2f6789ca95efbe29d0a5fc49a073d9e172de2ca2ae937491c4db0b734ea8198efefccd88228b70c9fbd5d27574ec
SSDEEP

768:tG/lAIEMxg3NZlpAzrY6+2vYHDmN43oJ:tG/lAWg9Z/AHYg7+W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
perl.exe

Files

perl.exe
.exe windows:4 windows x86 arch:x86

49f8614b263285803c60ef2ebc9844ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
abort
atoi
calloc
chdir
cygwin_conv_to_posix_path
cygwin_internal
dlclose
dlerror
dll_crt0__FP11per_process
dlopen
dlsym
exit
free
getenv
malloc
memcpy
memset
realloc
signal
strcpy
strlen
vsnprintf

advapi32

GetUserNameA
LookupAccountNameA

kernel32

CloseHandle
CopyFileA
CreateProcessA
FindClose
FindFirstFileA
FormatMessageA
FreeLibrary
GetComputerNameA
GetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetStdHandle
GetTickCount
GetVersionExA
GetVolumeInformationA
LoadLibraryA
SetLastError
Sleep
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msys-perl5_8

MallocCfg_ptr
PL_do_undump
PL_exit_flags
PL_markstack_ptr
PL_op
PL_perl_destruct_level
PL_sigfpe_saved
PL_stack_base
PL_stack_max
PL_stack_sp
PL_sv_no
PL_sv_undef
PL_sv_yes
PL_tainting
PerlIO_printf
Perl_PerlIO_stderr
Perl_block_gimme
Perl_croak
Perl_doing_taint
Perl_form
Perl_get_sv
Perl_malloc
Perl_mfree
Perl_mg_set
Perl_newRV
Perl_newSViv
Perl_newSVnv
Perl_newSVpv
Perl_newSVpvn
Perl_newXS
Perl_pad_sv
Perl_stack_grow
Perl_sv_2bool
Perl_sv_2iv
Perl_sv_2mortal
Perl_sv_2pv_flags
Perl_sv_grow
Perl_sv_mortalcopy
Perl_sv_newmortal
Perl_sv_setiv
Perl_sv_setpv
Perl_sv_setpvn
Perl_sv_taint
Perl_sv_upgrade
Perl_vmess
perl_alloc
perl_construct
perl_destruct
perl_free
perl_parse
perl_run

Exports

Exports

XS_DynaLoader_dl_error
XS_DynaLoader_dl_find_symbol
XS_DynaLoader_dl_install_xsub
XS_DynaLoader_dl_load_file
XS_DynaLoader_dl_undef_symbols
XS_DynaLoader_dl_unload_file
boot_DynaLoader
boot_Win32CORE
w32_CopyFile
w32_DomainName
w32_FormatMessage
w32_FsType
w32_GetCwd
w32_GetFullPathName
w32_GetLastError
w32_GetLongPathName
w32_GetNextAvailDrive
w32_GetOSVersion
w32_GetShortPathName
w32_GetTickCount
w32_IsWin95
w32_IsWinNT
w32_LoginName
w32_NodeName
w32_SetChildShowWindow
w32_SetCwd
w32_SetLastError
w32_Sleep
w32_Spawn

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 408B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 863B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f8614b263285803c60ef2ebc9844ae

Headers

File Characteristics

Imports

msys-1.0

advapi32

kernel32

msys-perl5_8

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 2KB - Virtual size: 2KB

.data_cy Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 408B

.edata Size: 1024B - Virtual size: 863B

.idata Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 2KB - Virtual size: 2KB

.data_cy
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 408B

.edata
Size: 1024B - Virtual size: 863B

.idata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB