client[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

client.exe
Size

565KB
MD5

e0a650498db3da882fb775a19334a2bf
SHA1

90c81b3a9e8d12eeb1edba5e187a75a1ae312e8a
SHA256

fdb7d172f42dd783edd4a331525626b5428c37ab1926892c994be72a2148b7ce
SHA512

499717d8e56f4074727aed384fa3e7c99bc55c4a247d138aeb70e3e117fdb3757b77fd55c2c6f798baa443a79f2875265da03841d614d49ed57bf83adcab80c4
SSDEEP

6144:nPbqld2LgqBDrtbBrzW7udhXwzPHPVMMs6TfpVkkhSSZoKStt8/3BdSzJ:nP23GlB/W7QhM1fhSSqmbw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

Files

client.exe
.exe windows:6 windows x64 arch:x64

79491f93e35d5fa1fe38f01bf49504cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

client.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

GetCurrentProcess
SetFileInformationByHandle
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetStdHandle
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
QueryPerformanceFrequency
RtlCaptureContext
lstrlenW
ReleaseMutex
HeapAlloc
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
QueryPerformanceCounter
CreateEventW
ReadFile
GetOverlappedResult
CancelIo
WaitForSingleObject
GetConsoleMode
SwitchToThread
SetThreadStackGuarantee
GetModuleHandleW
GetModuleFileNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThreadId
GetSystemTimeAsFileTime
DuplicateHandle
HeapFree
GetProcessHeap
FormatMessageW
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
GetDiskFreeSpaceExW
GetComputerNameA
CloseHandle
SetFilePointerEx
HeapReAlloc
IsProcessorFeaturePresent

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW

iphlpapi

GetAdaptersInfo

ws2_32

WSASocketW
getaddrinfo
closesocket
select
recv
getsockopt
setsockopt
WSAGetLastError
freeaddrinfo
connect
WSACleanup
WSAStartup
send
ioctlsocket

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

vcruntime140

memset
memmove
__CxxFrameHandler3
memcmp
memcpy
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_get_initial_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
terminate
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79491f93e35d5fa1fe38f01bf49504cf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

iphlpapi

ws2_32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 332KB - Virtual size: 331KB

.rdata Size: 216KB - Virtual size: 216KB

.data Size: 512B - Virtual size: 872B

.pdata Size: 13KB - Virtual size: 12KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 332KB - Virtual size: 331KB

.rdata
Size: 216KB - Virtual size: 216KB

.data
Size: 512B - Virtual size: 872B

.pdata
Size: 13KB - Virtual size: 12KB

.reloc
Size: 2KB - Virtual size: 1KB