sys[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sys.exe
Size

8KB
MD5

f45986e6aa17122c02eb960dcfdfc7bc
SHA1

c1ebfb04efb0392afeeb222eab2503f1a40bcf1b
SHA256

6908954284dcf0525f0acdec2a98e541234a6ca25410f94a2ec733b78ae57903
SHA512

39d98d3a14103d35cd581b0b808f26fea3e12afe11846c5608f78a40da3c265fef0af4e640627fa7cbdce48ef488e0fbe71dbb71df661c1aaf28c6cfef2d53f0
SSDEEP

96:qCq5D8ja36aAIafjOrDHmZJFjBOZS9EtiwyXwy8svD5BsV+8dAlqIPtboyn3tge:y5D8j+OKrDH2FtlvD5y+cAlhP1oyn3S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sys.exe

Files

sys.exe
.exe windows:4 windows x86 arch:x86

7fa958db981209cd401ebd14d78108f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetWindowsDirectoryA
GetLogicalDrives
SetFileAttributesA
GetDriveTypeA
CreateFileA
DeviceIoControl
CloseHandle
WriteFile
CreateDirectoryA
CopyFileA
CreateThread
OutputDebugStringA
GetModuleFileNameA
Sleep
GetLastError
lstrlenA
DeleteFileA
GetModuleHandleA
GetStartupInfoA

advapi32

ControlService
RegisterServiceCtrlHandlerA
SetServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
CloseServiceHandle
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
StartServiceA
QueryServiceStatus
StartServiceCtrlDispatcherA

shell32

ShellExecuteA

msvcrt

strpbrk
sprintf
strcat
strcpy
memset
malloc
memcmp
memcpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE