Gagarin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Gagarin.exe
Size

615KB
MD5

98976e6c05b58b343fdd4adbf310a7a3
SHA1

307d6124adec0c84efc74f3a768aec58da6988ca
SHA256

ebe610b913140bfa3798c3989f9d80c201a6f816f6e7f768ae2f37bdfa36ee82
SHA512

96d7d2a29e35aa641e1807454a203f4b90ed402782677e0e3e6fea184c41344885a67856589417580659b0e271d5972f45a64d52bec7b8e6766d7884849113de
SSDEEP

6144:HRirlrDzIphZ+wKAy1Hr6UwIHDqeKBIJ1TJkSTb3uo/vp7GJQNRASNRNuSeNR:xiRDa/KAprEDqeKIGEb3X1GJ8uS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Gagarin.exe

Files

Gagarin.exe
.exe windows:6 windows x86 arch:x86

9ea8f02b62caa02081060d07d28628e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\_dev\Projects\Gagarin v0.6\Release\Gagarin.pdb

Imports

msvcr120

_amsg_exit
_cexit
__crtTerminateProcess
__crtUnhandledException
__FrameUnwindFilter
_crt_debugger_hook

kernel32

GetThreadContext
DebugActiveProcessStop
IsProcessorFeaturePresent
Sleep
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentThread
CloseHandle
ContinueDebugEvent
WaitForDebugEvent
DebugSetProcessKillOnExit
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
GetCurrentProcess
DebugActiveProcess
OpenProcess
OpenThread
SetThreadContext
ReadProcessMemory
SuspendThread
ResumeThread
GetThreadSelectorEntry
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CheckRemoteDebuggerPresent
GetCurrentProcessId

advapi32

LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteW

mscoree

_CorExeMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 501KB - Virtual size: 501KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ea8f02b62caa02081060d07d28628e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr120

kernel32

advapi32

shell32

mscoree

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 501KB - Virtual size: 501KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 512B - Virtual size: 472B

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 501KB - Virtual size: 501KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 512B - Virtual size: 472B