X3AVAST[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

X3AVAST.exe
Size

3.7MB
MD5

95999ecae96d722d2cd30cced96054f8
SHA1

0e6849135acf4e5a88a49725ee84c12d505e5c3d
SHA256

b150773df7b525ce2b70822a06c06241f251eae96c9ee12fc97776d3826d36a7
SHA512

c64aa1dcecb8569fd565e1c70d540b63e7b47a74bd27f0327b58b88941c677ad87267c2e972f2040b6bbefd5ad19ba7f60b1ea0bb099bf5624518ecadc85e998
SSDEEP

98304:TDtCTMoQFiYCOEHQQjidyvXt7a2Zi8366FFO9lFJnN9XQbO:TwTeVsjVftHi8368FiFJnT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
X3AVAST.exe

Files

X3AVAST.exe
.exe windows:5 windows x86 arch:x86

5d9c682994f0e0d7b851b33e51f34448

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersion
GetVersionExA
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

EnumWindows

advapi32

RegQueryValueExA

oleaut32

GetActiveObject

version

GetFileVersionInfoSizeA

gdi32

SelectClipRgn

ole32

StringFromCLSID

comctl32

ImageList_DragLeave

winspool.drv

DocumentPropertiesA

shell32

SHGetFileInfoW

comdlg32

ChooseFontA

winmm

sndPlaySoundA

wsock32

inet_addr

ws2_32

WSARecv

Sections

CODE
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 9KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 52B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d9c682994f0e0d7b851b33e51f34448

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

winspool.drv

shell32

comdlg32

winmm

wsock32

ws2_32

Sections

CODE Size: - Virtual size: 1.5MB

DATA Size: - Virtual size: 43KB

BSS Size: - Virtual size: 9KB

.idata Size: - Virtual size: 14KB

.tls Size: - Virtual size: 52B

.rdata Size: - Virtual size: 24B

.vmp0 Size: - Virtual size: 3.2MB

.vmp1 Size: 3.7MB - Virtual size: 3.7MB

.reloc Size: 512B - Virtual size: 312B

.rsrc Size: 6KB - Virtual size: 5KB

CODE
Size: - Virtual size: 1.5MB

DATA
Size: - Virtual size: 43KB

BSS
Size: - Virtual size: 9KB

.idata
Size: - Virtual size: 14KB

.tls
Size: - Virtual size: 52B

.rdata
Size: - Virtual size: 24B

.vmp0
Size: - Virtual size: 3.2MB

.vmp1
Size: 3.7MB - Virtual size: 3.7MB

.reloc
Size: 512B - Virtual size: 312B

.rsrc
Size: 6KB - Virtual size: 5KB