stat[.]exe | Triage

Sharing

General

Target

stat.exe
Size

43KB
MD5

eb5ca8ef62b2a31e22f78afa928abd9b
SHA1

fe492b0f3b225caa5f846d7d5e9763f899cf6c19
SHA256

4a4b5ae053aa99cb813cbeb164442ccdf7b7ff76dfea200a37adc3e2ba209912
SHA512

c74aa62fd832d3be9f806a0cceed9faaeea5982a193145f5f813fc6a3fc11dcee18a638146173a74eefb2693e83d2c0577643deb2bba55c88f6348fe5e6836d2
SSDEEP

768:oeTXKsCrfT1Kf8jZ50Y/2A/NH+CoowHkvX55t2OOOPhyqVW:oHRUz+2OV+cwUkOO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stat.exe

Files

stat.exe
.exe windows:4 windows x86 arch:x86

16dfcfcbb80074255ccc3e87b452afc3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__errno
__main
_ctype_
_tzname
abort
access
asctime
atexit
calloc
ctime
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fputs
free
getenv
getgrgid
getpwuid
gmtime
localtime
lstat
malloc
mblen
memcpy
memset
putc
readlink
realloc
setgrent
setlocale
setpwent
stat
statfs
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strspn
tzset
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_sprintf
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 700B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE