mal[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

mal.exe
Size

21.2MB
MD5

70cdfe82c1e251712ecfa94ccf7b9fe8
SHA1

0f502067bbd279bf2ae0ded416735865e055d650
SHA256

5d5dfc562859d93150d90e82f7819d0e6c8622311e41967c543aa56400b95f84
SHA512

209465ee7724a57ce92f4f15447c56a16e32ed62ea1868cd8b7f1bc270f4fc8eee83aa269d8ae7ca6794df0288a9fbb0e7ca68ebd06f3ddd6af116c15048dee8
SSDEEP

393216:RYEkPzDqePFVuL59oZNYIMnPVsi5D+lvy12979uLjpLec3Z+rZ:7kbDxtVuL5mf3MH5alvyU97gjpi+i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mal.exe

Files

mal.exe
.exe windows:6 windows x64 arch:x64

8ecca1ead70ef274f3e3bb46d2914ce8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

advapi32

RegCloseKey
RegOpenKeyExW
SystemFunction036
RegQueryValueExW

kernel32

SetUnhandledExceptionFilter
GetSystemInfo
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
SwitchToThread
CloseHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetLastError
HeapReAlloc
QueryPerformanceCounter
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
CreateWaitableTimerExW
Sleep
SetWaitableTimer
WaitForSingleObject
GetStdHandle
GetConsoleMode
WideCharToMultiByte
GetCommandLineW
SetLastError
GetModuleFileNameW
CreateFileA
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetSystemTimePreciseAsFileTime
GetTimeZoneInformationForYear
SetConsoleCursorPosition
SetConsoleMode
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
CreateFileW
GetQueuedCompletionStatusEx
GetFinalPathNameByHandleW
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetModuleHandleA
GetProcAddress
PostQueuedCompletionStatus
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
ReadConsoleW
CreateThread
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
SetHandleInformation
SetFilePointerEx

crypt32

CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertDuplicateStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy

bcrypt

BCryptGenRandom

ws2_32

WSAStartup
freeaddrinfo
setsockopt
getaddrinfo
shutdown
socket
recv
send
WSASend
closesocket
ioctlsocket
connect
getsockopt
WSAIoctl
getsockname
WSAGetLastError
getpeername
WSASocketW
bind
WSACleanup

ntdll

NtCancelIoFileEx
NtCreateFile
NtWriteFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile

secur32

DeleteSecurityContext
ApplyControlToken
DecryptMessage
FreeContextBuffer
AcquireCredentialsHandleA
FreeCredentialsHandle
EncryptMessage
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW

vcruntime140

memcpy
__current_exception_context
__current_exception
memcmp
__CxxFrameHandler3
memmove
memset
__C_specific_handler

api-ms-win-crt-math-l1-1-0

fmod
__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_crt_atexit
_exit
exit
_c_exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
_initterm_e
terminate
_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.X^C
Size: - Virtual size: 13.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.~OH
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.S4s
Size: 21.2MB - Virtual size: 21.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ecca1ead70ef274f3e3bb46d2914ce8

Headers

DLL Characteristics

File Characteristics

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

crypt32

bcrypt

ws2_32

ntdll

secur32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: - Virtual size: 1.7MB

.rdata Size: - Virtual size: 652KB

.data Size: - Virtual size: 2KB

.pdata Size: - Virtual size: 25KB

.X^C Size: - Virtual size: 13.1MB

.~OH Size: 2KB - Virtual size: 1KB

.S4s Size: 21.2MB - Virtual size: 21.2MB

.reloc Size: 512B - Virtual size: 288B

.text
Size: - Virtual size: 1.7MB

.rdata
Size: - Virtual size: 652KB

.data
Size: - Virtual size: 2KB

.pdata
Size: - Virtual size: 25KB

.X^C
Size: - Virtual size: 13.1MB

.~OH
Size: 2KB - Virtual size: 1KB

.S4s
Size: 21.2MB - Virtual size: 21.2MB

.reloc
Size: 512B - Virtual size: 288B