Estonia3[.]ps1 | Triage

Sharing

General

Target

Estonia3.ps1
Size

94KB
MD5

cda4e955c9ed698a1df4ce736eb39d76
SHA1

e8dacd52cb34c3d34bfe4a117511ce3991b2ae94
SHA256

2812bff1ead67a077addcb6191a223fb213d4382610ba78c30bd410190195dc5
SHA512

1a191d842b90afa223087dd71bed309a81f62405ac704e0c7d25879723723f67dcde88ffa70619eecc3b9e729df3d6e79476674d3f1c51f02739913486fd38a2
SSDEEP

1536:2BDgolBDgoI7ZD2wNbdV+3h3t8OUEH23LiorMb6T9EDpVUjCQan38d8vRCg0cvoX:3owom2rqoFo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Estonia3.ps1

Files

Estonia3.ps1
.exe .hta .js windows:10 windows x86 arch:x86 polyglot

e039c46e30a89abaf651718c922747b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dvdplay.pdb

Imports

advapi32

RegGetValueW

kernel32

SearchPathW
CreateProcessW
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess
GetCurrentProcess

msvcrt

_acmdln
__setusermatherr
_controlfp
_except_handler4_common
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_initterm
?terminate@@YAXXZ
memset

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ