sckutist[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

sckutist.exe
Size

17.4MB
MD5

a9185b4d5176d77782816f02b8554482
SHA1

f627d754672d7c589fb05a3d9011f9cfbf1b16dd
SHA256

75051abfe6abeb92258f08d24a9eb551ed5b558b68302c8d5c08258dfc47c491
SHA512

0036d1fa62b1fd23dd956c552aa0e19b810bd5bc6c3e431c4421dab3739231bcbe60c2c4fba5b3537b0a8a273dfbd6da806cbf5481c9ceaad0c313b1772d1e30
SSDEEP

393216:r2mq8LguQNiFhSjQn3Ykqt0wFD/8OgyA88TofH/u:Kmq88lk3bo8wV/8Ogy18Tof/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sckutist.exe

Files

sckutist.exe
.exe windows:6 windows x64 arch:x64

74dab97d830bce0db06d44893acaae19

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

normaliz

IdnToAscii

ws2_32

freeaddrinfo

wldap32

ord41

crypt32

CertFreeCertificateChainEngine

advapi32

CryptDestroyKey

libcrypto-3-x64

AES_set_decrypt_key

kernel32

ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

BlockInput

shell32

ShellExecuteA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

ntdll

RtlGetFullPathName_UEx

rpcrt4

UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

_dclass

Sections

.text
Size: - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xorstr0
Size: - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xorstr1
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xorstr2
Size: 17.3MB - Virtual size: 17.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74dab97d830bce0db06d44893acaae19

Headers

DLL Characteristics

File Characteristics

Imports

normaliz

ws2_32

wldap32

crypt32

advapi32

libcrypto-3-x64

kernel32

user32

shell32

msvcp140

ntdll

rpcrt4

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 512KB

.rdata Size: - Virtual size: 122KB

.data Size: - Virtual size: 36KB

.pdata Size: - Virtual size: 20KB

.xorstr0 Size: - Virtual size: 10.4MB

.xorstr1 Size: 10KB - Virtual size: 10KB

.xorstr2 Size: 17.3MB - Virtual size: 17.3MB

.reloc Size: 512B - Virtual size: 260B

.rsrc Size: 15KB - Virtual size: 15KB

.text
Size: - Virtual size: 512KB

.rdata
Size: - Virtual size: 122KB

.data
Size: - Virtual size: 36KB

.pdata
Size: - Virtual size: 20KB

.xorstr0
Size: - Virtual size: 10.4MB

.xorstr1
Size: 10KB - Virtual size: 10KB

.xorstr2
Size: 17.3MB - Virtual size: 17.3MB

.reloc
Size: 512B - Virtual size: 260B

.rsrc
Size: 15KB - Virtual size: 15KB