msbuild[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

msbuild.exe
Size

3.6MB
MD5

77b8c18bece02b6cfa33f68c743b3c3c
SHA1

43e5e948457c22e09951e6b7b5ab9cd64bbec623
SHA256

e19de62c82f499f2f3748136c337222c2f67effba91e6252fdc9ece2f20595d9
SHA512

f9ba19828957665fb9268ee516800504f98e8e31b6c433841a9a6170ae87adbfa4c4cff9f8ba34edca258cbc5b34d22dad325c278c17c4ef6428f1c22472685a
SSDEEP

49152:T13hnx0+HdYgtb20mCnChhO+TA/5oGSWxHP+RJcGZ12yP32aVb5S:pG2n1Si+RJcGy82aVE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
msbuild.exe

Files

msbuild.exe
.exe windows:6 windows x64 arch:x64

fc51f74b94b4bc6fd2beb5108763e894

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\asdasd\x64\Output\Release\teger.pdb

Imports

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree

kernel32

CreateProcessW
AssignProcessToJobObject
PeekNamedPipe
GlobalMemoryStatusEx
CreateJobObjectW
GetSystemDirectoryW
GetStartupInfoW
CreatePipe
DeleteCriticalSection
TerminateJobObject
GetConsoleWindow
GetModuleFileNameW
WideCharToMultiByte
LeaveCriticalSection
WriteFile
EnterCriticalSection
ReadFile
SetEndOfFile
WriteConsoleW
GetFileSize
CreateFileA
FindClose
FindNextFileA
FileTimeToSystemTime
FindFirstFileA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
GetLogicalDriveStringsW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleOutputCP
GetCommandLineW
GetCommandLineA
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
FreeLibrary
RtlPcToFileHeader
InterlockedPushEntrySList
RtlUnwindEx
OutputDebugStringW
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSection
Sleep
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
CreateEventW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeSListHead
ReadConsoleW
ReadConsoleA
GetSystemTimeAsFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcessorNumber
RtlUnwind
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
GetLastError
SetLastError
TryAcquireSRWLockExclusive
TlsGetValue
TlsSetValue
GetSystemInfo
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
ResetEvent
VirtualAlloc
VirtualFree
TlsAlloc
SwitchToThread
CreateFileW
CreateFileMappingW
MapViewOfFileEx
lstrlenW
UnmapViewOfFile
TlsFree
GetStdHandle
GetFileType
DeleteFiber
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
GetCurrentProcessId
ConvertFiberToThread
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode

user32

EnumDisplaySettingsW
EnumDisplayMonitors
GetDC
GetDesktopWindow
ShowWindow
GetWindowLongW
SetWindowLongW
SetWindowPos
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfW
GetMonitorInfoW

gdi32

CreateCompatibleBitmap
SelectObject
GetObjectW
GetDIBits
BitBlt
CreateCompatibleDC

advapi32

CryptDestroyHash
CryptGenRandom
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
RegCloseKey
RegQueryValueExW
RegOpenKeyW
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptDestroyKey

shell32

SHGetKnownFolderPath

oleaut32

VariantInit

ws2_32

WSAIoctl
WSASetLastError
shutdown
send
htons
getsockname
getpeername
closesocket
WSAGetLastError
gethostname
ntohl
ntohs
WSAStringToAddressW
getaddrinfo
freeaddrinfo
InetNtopW
bind
socket
WSAStartup
WSACleanup
connect
recv
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
setsockopt

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

shlwapi

StrChrW

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc51f74b94b4bc6fd2beb5108763e894

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

user32

gdi32

advapi32

shell32

oleaut32

ws2_32

crypt32

bcrypt

shlwapi

winmm

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 63KB - Virtual size: 2.1MB

.pdata Size: 107KB - Virtual size: 106KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 63KB - Virtual size: 2.1MB

.pdata
Size: 107KB - Virtual size: 106KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 36KB - Virtual size: 35KB