keygen[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

keygen.exe
Size

1.5MB
MD5

d5385d77eccf60ebe928a80c97eae04e
SHA1

12f8e6d9371b6efe7d4a8aef7029a99b7c63b8c8
SHA256

0c73813804c68e7ed7225268994809379d7a1ff9ffb1b6f43e35a0df56e53661
SHA512

360283faecf3b5127c9bde2f91a66e370592f6d903acc2bec1c700056c5d358730e7202f91527ab86ce6d30aef55c121c5f02fbea27f34b8d8f391f5252ed0a1
SSDEEP

49152:WcCKwV82DU4eWgIVmty75g9hJbWimYJmzL335:/CKwV82FeLs6AC9bmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keygen.exe

Files

keygen.exe
.exe windows:6 windows x86 arch:x86

850118dc35c27bad21c95b079f592c45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\kekin\source\repos\Imagiro Keygen\Release\Imagiro Keygen.pdb

Imports

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
Sleep
GetCurrentProcessId

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
abort

vcruntime140

_except_handler4_common
_CxxThrowException
memmove
__FrameUnwindFilter
__std_exception_copy
__std_exception_destroy
__current_exception_context
__current_exception
memset

msvcp140

?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-time-l1-1-0

_time64
clock

api-ms-win-crt-utility-l1-1-0

srand
rand

mscoree

_CorExeMain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

850118dc35c27bad21c95b079f592c45

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-heap-l1-1-0

kernel32

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

mscoree

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB