paed[.]exe | Triage

Sharing

General

Target

paed.exe
Size

67KB
MD5

8928453e55390ac3722898cb0653a9a7
SHA1

0431ad2d10bdafb04563062a9e5f83ef3020bba2
SHA256

2513986f8d1675a905e9f2e8ce3e7e1029e1c4c1dc704468091eb9c5e4d6be1f
SHA512

c2114bb08f1b81335c241b692fef9c5916c89d1a80c1652c30c995c67cd31bbf3d092c3fcb9023b98607603c34d25c5e35075effd58103a5a00694379f40401f
SSDEEP

1536:6lM3UCxVlATYPMcM4BmLDHSWNfJQ+ckCNiX1mjjZ59i:l3UCxETcMcM4BmKWbVogklm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
paed.exe

Files

paed.exe
.exe windows:5 windows x64 arch:x64

67dc25afe40e44ae67e9b5b773158cc9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

kernel32

Process32NextW
CreateToolhelp32Snapshot
GetThreadContext
RemoveVectoredExceptionHandler
LoadLibraryW
AddVectoredExceptionHandler
Process32FirstW
CreateProcessW
OpenProcess
GetModuleHandleW
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleA
GetProcAddress
GetModuleFileNameW
Sleep
GetCommandLineW
ExitProcess
CloseHandle
VirtualAlloc
CreateFileW
ReadFile
VirtualFree
GetCurrentThread
GetFileSize
RtlUnwindEx

user32

FindWindowW

advapi32

GetUserNameW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ