sh[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sh.exe
Size

550KB
MD5

67145ed7b7d449984ef3adc268a49299
SHA1

2cacb3d8ec3973c00dc0cef8f63c83178255f794
SHA256

ae9df97e4d30f93b54a9b822459830a6e85e7e31300dc003bbf6f31cd16dcb40
SHA512

a208f1077442c3c4ab024991314cc33c35c55a582f0489566811f7ed4f8b3d8720fd171bc6f007a6c037cadb2b53964ff538fc4c9317495c1d3e3d8d8a236fa0
SSDEEP

12288:d85qeTmD9atbiYTNEHWlq3hoPMcoEVKiezN968jyTm:SqRctbiQwWA3iPhyHrj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sh.exe

Files

sh.exe
.exe windows:4 windows x86 arch:x86

6e16c2335da176eecd991ca43597cd08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
abort
access
alarm
atoi
atol
bcopy
calloc
chdir
close
closedir
connect
cygwin_conv_to_full_posix_path
cygwin_conv_to_posix_path
cygwin_conv_to_win32_path
cygwin_internal
dlclose
dlerror
dll_crt0__FP11per_process
dlopen
dlsym
dup
dup2
endgrent
endpwent
execve
exit
fclose
fcntl
fdopen
fflush
fgets
fileno
fopen
fork
fprintf
fputc
fputs
free
fstat
fwrite
getcwd
getdtablesize
getegid
geteuid
getgid
getgrent
getgroups
gethostbyname
gethostname
getpeername
getpgrp
getpid
getppid
getpwent
getpwnam
getpwuid
getrlimit
getrusage
getservbyname
gettimeofday
getuid
inet_aton
ioctl
isatty
isinf
isnan
kill
killpg
localeconv
localtime
longjmp
lseek
lstat
malloc
memcpy
memmove
memset
mkfifo
open
opendir
pathconf
pipe
printf
putc
putchar
puts
qsort
read
readdir
readlink
realloc
sbrk
select
setdtablesize
setgid
setgrent
setjmp
setlocale
setmode
setpgid
setpwent
setrlimit
setuid
setvbuf
sigaction
sigaddset
sigdelset
sigemptyset
sigprocmask
sleep
snprintf
socket
sprintf
stat
strcasecmp
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncasecmp
strncmp
strncpy
strpbrk
strrchr
strsignal
strstr
strtod
strtoul
sysconf
tcflow
tcgetattr
tcgetpgrp
tcsetattr
tcsetpgrp
time
ttyname
tzset
umask
unlink
vfprintf
vsnprintf
waitpid
write

msys-regex-1

regcomp
regexec
regfree

msys-termcap-0

tgetent
tgetflag
tgetnum
tgetstr
tgoto
tputs

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

user32

CloseClipboard
GetClipboardData
OpenClipboard

Sections

.text
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6e16c2335da176eecd991ca43597cd08

Headers

File Characteristics

Imports

msys-1.0

msys-regex-1

msys-termcap-0

kernel32

user32

Sections

.text Size: 445KB - Virtual size: 445KB

.data Size: 98KB - Virtual size: 98KB

.data_cy Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 16KB

.idata Size: 4KB - Virtual size: 4KB

.text
Size: 445KB - Virtual size: 445KB

.data
Size: 98KB - Virtual size: 98KB

.data_cy
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 16KB

.idata
Size: 4KB - Virtual size: 4KB