DeadSecRootKit[.]exe | Triage

Sharing

General

Target

DeadSecRootKit.exe
Size

151KB
MD5

b8479a23c22cf6fc456e197939284069
SHA1

b2d98cc291f16192a46f363d007e012d45c63300
SHA256

18294ee5a6383a48d1bcf2703f17d815529df3a17580e027c3efea1800900e8f
SHA512

786cd468ce3723516dc869b09e008ec5d35d1f0c1a61e70083a3be15180866be637bd7d8665c2f0218c56875a0ee597c277e088f77dd403bdd2182d06bad3bd4
SSDEEP

3072:9QpsyzjtpfkzW/7F/ix/ApwXnDLn10FbxYSC/B9KIZb29b/HvX:9QpsyzjtpfOW/7FO/AKL10FbmlBoIYRn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DeadSecRootKit.exe

Files

DeadSecRootKit.exe
.exe windows:6 windows x86 arch:x86

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrNCatW
StrStrIW
StrCatW
StrCpyW

kernel32

SizeofResource
GetCurrentProcess
FindResourceA
GetModuleHandleA
LockResource
GetProcAddress
IsWow64Process
ExitProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
LoadResource

advapi32

RegSetValueExW
CryptAcquireContextW
CryptGenRandom
RegOpenKeyExW
CryptReleaseContext

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ