tail[.]exe | Triage

Sharing

General

Target

tail.exe
Size

45KB
MD5

a85710209c0786f7db3c7236aa5c2c0d
SHA1

745421bb71ab291a4fb89d54368c7dd15e892b91
SHA256

ab172648439f211195d98415e69acb90b9c3c0cf1f1b657fb5e6eca7f37277b4
SHA512

fc2dcf5c3f616bb4d0f612b33ef5430b79348fdaa6fa65c84ee80431d63891e390d3f6a3642d5e64661af390e530d4abdcfe84752bfb93cb309348d7cdcd7230
SSDEEP

768:2rG64Sk6TyyJJ5fUc5x+b7Q4pudTJWclf0ytIjwPySCp0paOJPhyqVWNKJF:2x1TdHdf80VJWcmwstOMK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tail.exe

Files

tail.exe
.exe windows:4 windows x86 arch:x86

a3443b68cb57692bf40b66e819d1f8a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msys-1.0

__assert
__errno
__main
_ctype_
_read
abort
atexit
calloc
close
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fcntl
fflush
fputs
free
fstat
fwrite
getenv
isatty
kill
lseek
malloc
memchr
memcpy
memset
open
putc
realloc
select
setlocale
sigaction
sigemptyset
strchr
strcmp
strerror
strlen
strncmp
strtod
strtol
strtoul
vsnprintf

msys-intl-8

__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf

kernel32

GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data_cy
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 700B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE