shred[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

shred.exe
Size

43KB
MD5

4872b8459f24a888293a7025f6fb37de
SHA1

c4baa0a4a0501e067c0106e7103c4da51943fcfa
SHA256

8e07ac7dea8993ac572facef31055c3d26dcf31aeb98ef4ba7a8cab48d4a8ed6
SHA512

afc764ee03535029c6d57ea7d6788d5cb82cb51265f69f3eee8752dc1bf1722460d9598db5084a6b5acda397659f6f925952e665a15bebb10b8138107c5c4672
SSDEEP

768:DbtfVfmIA8ems15S0mO1t4CtGEexVOcOgz6zFfzAYFwDn0ELw3aA2oNs53OOPhyO:DbtNiF10O1t4CteVqm8d8Nwn253O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shred.exe

Files

shred.exe
.exe windows:4 windows x86 arch:x86

925a227b2c2774f101ed3abf482bf83c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__assert
__errno
__main
_ctype_
abort
atexit
calloc
chmod
close
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fcntl
fflush
fputs
free
fstat
fsync
ftruncate
getenv
getgid
getpid
getppid
gettimeofday
getuid
isatty
localeconv
lseek
lstat
malloc
memcpy
memmove
memset
open
putc
read
realloc
rename
setlocale
strchr
strcmp
strcpy
strerror
strlen
strncmp
sync
time
unlink
vsnprintf
write

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_sprintf
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 540B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE