ps[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ps.exe
Size

16KB
MD5

bd6cab599f265d1b92add1b468197c5a
SHA1

6c210ff77e67f120f324539509cd1526a182747b
SHA256

811ee8119f5bbd54c6694eea672aa7f1fd54953463862ba161f4e575eb407bdd
SHA512

9c1d8aff5402805efb0a0ed35d972ed242087beba8e076b1bf95fa7c0cb882d273d4e2b17f3f80972b6f6cf6887bde95740ecfe535d2f9b4ab6bdd655c2d33aa
SSDEEP

96:yhzaxHfZ52AtQa33CUVCQh81IkDLq+J5WIJ5mOVpNoynh9UK1UxKv1cY5x:y2BeKykh8+GLq+XWIXmO/NoynhVOu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ps.exe

Files

ps.exe
.exe windows:4 windows x86 arch:x86

94eec2136b28a12887e9f8ce202ced18

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep

mfc42

ord1105

msvcrt

printf
exit
strncpy
strchr
strstr
atoi
_strtime
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp
_strlwr

wsock32

gethostbyname
ntohl
ioctlsocket
inet_addr
ntohs
shutdown
__WSAFDIsSet
select
connect
closesocket
inet_ntoa
htons
htonl
WSAGetLastError
socket
WSACleanup
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE