custom[.]exe | Triage

General

Target

custom.exe
Size

88KB
MD5

584e30187f4cccaba789edfa4b8a9f62
SHA1

f4fe798dd97fcfcea48c4c85047d3a9fbad2b9e8
SHA256

80d404fa2f616e8043744ade0dd9441dda09f4c6be0bd60bb053ac37d4530da5
SHA512

425ae17f30a8d3801de48f5aa1dd7eb9aa67087e3e93435a67dfacb8ec3137c88f763502e3bb399fd59264cd46dce70dcba11fcc3361a4b57d0dee6dace6c867
SSDEEP

768:WDclIcoK+sgqmEBqLBwGgYoe3rrtja2gPbW6txiiK5/4gqZU9yp:WDcl5OqAzoZPh65/Ab

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
custom.exe

Files

custom.exe
.exe windows:5 windows x86 arch:x86

d89f33c4478d93f7f88ba0325c4cf65f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\cygwin\home\zun\prog\th12\src\th_custom\Release\custom.pdb

Imports

kernel32

ReadFile
CloseHandle
GetFileSize
CreateFileA
WriteFile
LocalFree
FormatMessageA
GetLastError
GetStringTypeW
HeapAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA

user32

DialogBoxParamA
KillTimer
IsDlgButtonChecked
MessageBoxA
SetTimer
EndDialog
GetDlgItem
SendMessageA

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d89f33c4478d93f7f88ba0325c4cf65f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 49KB - Virtual size: 48KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 49KB - Virtual size: 48KB