rootkit[.]ex1 | Triage

Sharing

General

Target

rootkit.ex1
Size

74KB
MD5

9219e2cfcc64ccde2d8de507538b9991
SHA1

181e59600d057dc6b31a3b19d7f4f75301a3425e
SHA256

5af3fd53aea5e008d8725c720ea0290e2e0cd485d8a953053ccf02e5e81a94a0
SHA512

81aa2fbde8567f4a3446d56a8fec8b346f9c4093f5baa32db4069644ad3fec64c6c2d749173557e5247144b92fa12ddb14de55ca3687867d4aea4c37124c9f54
SSDEEP

1536:m+6OXCt1SXBW0bBaKLXDduSOxqEDX0+G3L6f2X4ZmfwhRYE:/6Y41aBNbBBXkSCPDMV4hmE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rootkit.ex1

Files

rootkit.ex1
.exe windows:1 windows x86 arch:x86

68b959f526f1bb79907383ec0f4e13e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CompareFileTime
ExitProcess
GetCurrentThread
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileSize
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalFree
IsDebuggerPresent
LoadLibraryA
SearchPathA
SetProcessAffinityMask
Sleep
SleepEx
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
lstrcatA
lstrcmpA
lstrlenA

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SetBkColor
SetTextColor

user32

AppendMenuA
EndDialog
EqualRect
FindWindowA
FindWindowExA
GetMenu
GetMessagePos
InvalidateRect
IsCharUpperA
LoadCursorA
MessageBoxA
PostQuitMessage
ScreenToClient
SetCaretPos
TrackPopupMenuEx

Sections

.dKVU
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cPBG
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aFUR
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rOPG
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ