what-encrypt[.]exe | Triage

Sharing

General

Target

what-encrypt.exe
Size

263KB
MD5

d61c38b3d1ba714b8455eb2cf6021bac
SHA1

3d81c5d0643886d4cf3d358e274c7fbb83f72021
SHA256

ad533886f13a9753d17974ad2836712504e59460675f354d7d84329b157df08c
SHA512

42b36e010d534a7b975fee95707172fa63dd466bfad6adb38c401098911a5beb6accd5c6972a3b859ae0938e894524bcdb1dbc68d96214bf9412b7108885ce49
SSDEEP

6144:hLP6qRuHl7BuEHwRgDDQWC+H6fqmt3N5bJEjJ:hOqwHltucwRM4FjJE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
what-encrypt.exe

Files

what-encrypt.exe
.exe windows:4 windows x86 arch:x86

1bda3c233be6f701b8ead97440958cd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW

user32

CreateCursor

advapi32

RegOpenKeyExW

shell32

ShellAboutW

mscoree

_CorExeMain

comctl32

InitMUILanguage

Sections

Size: - Virtual size: 40KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE