SolarTEMPV2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SolarTEMPV2.exe
Size

5.9MB
MD5

c7f8fdd854278071981705f72df64fa1
SHA1

edec4b848f293fa8553da40cbe7e003839356df9
SHA256

84d63cf8c6935cf30122cd0b810253444e5d9335b7876f8e949b2d1bb9cfcb46
SHA512

73634eb69fba265e83abae3dc1005b371046faefbf4bbbada17ac2456eeba4b0bc30e3ab7c1e538e4437ce36a30d879e23f136b02bdfa731a10b7d7c0e9555e6
SSDEEP

98304:+3sv8rCeTlzY63PuI4Tv63Kvd7kmAFe+lG9KAcv7JN+6d4oV4O:+8sCkzY62I/kdtOL4oDJNUU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SolarTEMPV2.exe

Files

SolarTEMPV2.exe
.exe windows:4 windows x86 arch:x86

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ