seppuku[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

seppuku.exe
Size

358KB
MD5

1f6314c041caafc3dcb005c31c0704f6
SHA1

76436fa5f43f64d071464eb95c78e3649ae34d61
SHA256

6cbb02eab866d85f92f142a3a1a69989166b7d5b6f49e27a8690b173ebbae302
SHA512

f4db4162002859e3e8bd4efc8b6a80820945d26ba1541a14afd003e2106c100faf7f7e7dc4e2aca7773494f088ba1659e09a40b3dc0d74e0508bc39c77411f66
SSDEEP

6144:Nt6XZY/zc1NvYzEwRjfqMTiRN8qoxkWonRY:Nt6XGgzCMMsToxC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
seppuku.exe

Files

seppuku.exe
.exe windows:6 windows x64 arch:x64

cf4091828b1c1d7beb9de80666edf147

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

seppuku.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

netapi32

NetGetJoinInformation

ole32

CoTaskMemFree

kernel32

GetLastError
UnhandledExceptionFilter
FormatMessageW
HeapFree
HeapAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetProcessHeap
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentThreadId
SetFileInformationByHandle
GetCurrentProcess
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObject
IsDebuggerPresent
GetProcAddress
CloseHandle
GetFileInformationByHandle
GetCurrentProcessId
GetConsoleMode
GetStdHandle
SetUnhandledExceptionFilter
HeapReAlloc
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandleEx
FindFirstFileW
GetFileType
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW
GetFullPathNameW
GetModuleHandleA
IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError
NtWriteFile

vcruntime140

memmove
__current_exception
__CxxFrameHandler3
__C_specific_handler
memcpy
memcmp
memset
_CxxThrowException
__current_exception_context

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_get_initial_narrow_environment
_initterm
_exit
__p___argc
_initterm_e
terminate
_crt_atexit
exit
_register_onexit_function
_initialize_onexit_table
__p___argv
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 261KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf4091828b1c1d7beb9de80666edf147

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

netapi32

ole32

kernel32

ntdll

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 261KB - Virtual size: 261KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 776B

.pdata Size: 17KB - Virtual size: 17KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 261KB - Virtual size: 261KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 776B

.pdata
Size: 17KB - Virtual size: 17KB

.reloc
Size: 1KB - Virtual size: 1KB