Stager[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Stager.exe
Size

163KB
MD5

a2f16c402d48697fa77a05d587735c49
SHA1

4124df17fc8767b3ee4802b4d57139bb4d07e46f
SHA256

f16739ee52bdd3e98c4f7ee76d414857a4228075ba808599d45facf4ff850254
SHA512

ff4675c026089fc6e7cb7ff9fd5d604a06df07a93ebaae85830b57b4fb73dd4e0d29d74078387e0279f485e127b637650ca8c648f2e7f19cca38eea9e9fd8a9f
SSDEEP

3072:ZQps0KixjKIJD2qU0yYffeP5hagS7+xpNgWSvASh+XffIZkQnBFjbzP4:ZQps0KixjKIJDoCfeHzSCpexa4mQnLXc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Stager.exe

Files

Stager.exe
.exe windows:6 windows x86 arch:x86

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrNCatW
StrStrIW
StrCatW
StrCpyW

kernel32

SizeofResource
GetCurrentProcess
FindResourceA
GetModuleHandleA
LockResource
GetProcAddress
IsWow64Process
ExitProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
LoadResource

advapi32

RegSetValueExW
CryptAcquireContextW
CryptGenRandom
RegOpenKeyExW
CryptReleaseContext

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ