Kirurg[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Kirurg.exe
Size

10KB
MD5

50c55b0a2c48f5010b81153879bf58c5
SHA1

d1df6ee86302ce5fa4270acdb376493d5c60d67e
SHA256

7b90e3c35bd147455868f54df6951554bfbed2d5f4c0b185a8b1895b4e07538c
SHA512

f7d5b624b7ff2383d8f0f2fd6da9e921158ebac950e2288be64191e40d26631c27042ad7bfdf80a17fcae1996f01247b195d6d8faf6deb7bdbcbfa27d957f245
SSDEEP

192:gH4i/jQcfb2inwzjOh4cohVi07E5pz63JoZZub:gH4i7QcjxnCjDh407STub

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kirurg.exe

Files

Kirurg.exe
.exe windows:6 windows x86 arch:x86

116e2e586a9713569b23d26f7193468c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Visual Studio Projects\lukatest\Release\Kirurg.pdb

Imports

kernel32

GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetTickCount
CreateThread
GetCurrentProcessId
Sleep
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW

user32

GetSystemMetrics
ReleaseDC
GetDC
MessageBoxA

gdi32

BitBlt
SelectObject
PatBlt
StretchBlt
DeleteObject
CreateSolidBrush

vcruntime140

_except_handler4_common
__current_exception_context
memset
__current_exception

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argc
_initterm
_initialize_onexit_table
exit
_cexit
_crt_atexit
_controlfp_s
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_initterm_e
__p___argv
_register_onexit_function
_exit
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

116e2e586a9713569b23d26f7193468c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 904B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 440B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 904B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 440B