GAC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GAC.exe
Size

9.5MB
MD5

129f9b7af49ded4e098d2d41c1e77c31
SHA1

a6b1bf68c1918ab4a3fb52d49c0c99fbd38a297c
SHA256

9029776b7df419640aba4f14d8744bc0b7e3f729a823871c41c2029aeb3e102f
SHA512

0b76e00b7f8016748734b8e37d1618b4511538f5aa5cef9306d0ea15c92306fd3dab6e1184db5e45da305459ba68bc5e539f18c6c4f184902ac9b66a9677a51e
SSDEEP

196608:Il3o5skTfPkFuShOVSYDgi852RbuFFbYE1:K4+4kEShOcm852J4bY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GAC.exe

Files

GAC.exe
.exe windows:6 windows x86 arch:x86

0bca2978b7c5afe6e4aa108ec3f0e1de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid

shell32

ShellExecuteA

kernel32

SetEndOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

Sections

.text
Size: - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.\63
Size: - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.A8K
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

._&:
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ