ANTIPUSK[.]EXE | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ANTIPUSK.EXE
Size

7KB
MD5

e29569e42b85bd880c54d22524248237
SHA1

3d34ca85f067172c192eda7722948e25538d65fe
SHA256

126bc70dfcd987397d69da9f14e5535e79165c0036add6815659abc80d10f2ca
SHA512

0bf6f216f78e702312ebc48285a8e10913373cfac51fa3b5da3f6ceaeb8d42b792f8d86c5b1bccd53900e8e3d07c3feae2feb9d3eed34ecd96ec99696f15a534
SSDEEP

96:V/HAnz7Qln+HqIEA6rTIRStjNjIYZgWFiny:CnmUmdIRSLj9M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ANTIPUSK.EXE

Files

ANTIPUSK.EXE
.exe windows:4 windows x86 arch:x86

fe87fbac7dcfa4c327728422c7622324

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

puskdll

?HookProc@@YGJHIJ@Z
?hHook@@3PAUHHOOK__@@A
?SetWindows@@YAXPAUHWND__@@0@Z

msvcrt

_exit
exit
__p__acmdln
_initterm
_XcptFilter
__getmainargs
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__setusermatherr

kernel32

GetStartupInfoA
GetModuleHandleA

user32

TranslateMessage
GetMessageA
FindWindowA
EnumChildWindows
GetClassNameA
DefWindowProcA
UnhookWindowsHookEx
DispatchMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
SetWindowsHookExA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 278B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ