mstsc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mstsc.exe
Size

1.1MB
MD5

2097b2283d3abdfa7e8e34f2f9d90b7e
SHA1

98337a9e262afc1ccc33f3f3d21376e992517344
SHA256

65e8b49ad50cf6e47c1e93f0b77e64082ce5186fdd5e8ccb924c372085623673
SHA512

65c58a9b560873648d93d0eed7c2863d4a204e54ff789c05b4ee5b614b0dd50ae208addefd4b5ba9b91a55b1355d3fd4f4aba59f376552a5e1510eddc05316cc
SSDEEP

24576:3TNcUyMBbXBRB7xOy9hz+kGy0TD6Xei2tDnWykErI9V:D9fFFX4Wykh9V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mstsc.exe

Files

mstsc.exe
.exe windows:10 windows x86 arch:x86

db9da44923bca4957b0ed72c815a22aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstsc.pdb

Imports

user32

IsRectEmpty
PtInRect
GetClassInfoW
DefDlgProcW
RegisterClassW
MessageBoxW
GetMenuItemCount
InsertMenuItemW
AllowSetForegroundWindow
CreateDialogParamW
CharNextW
DialogBoxParamW
LoadAcceleratorsW
MsgWaitForMultipleObjectsEx
PeekMessageW
MonitorFromWindow
SystemParametersInfoW
LoadStringW
SetProcessDPIAware
GetKeyboardLayout
CharLowerW
EnumDisplayDevicesW
FillRect
CheckRadioButton
DrawIconEx
GetWindow
MapDialogRect
ScreenToClient
SubtractRect
GetMonitorInfoW
GetWindowDC
GetFocus
DrawTextW
EnumDisplayMonitors
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogIndirectParamW
EndPaint
DrawIcon
BeginPaint
SendDlgItemMessageW
MapWindowPoints
ReleaseDC
GetDC
IsWindowEnabled
UnregisterClassA
SetTimer
GetMenu
KillTimer
ShowWindowAsync
AdjustWindowRectEx
EnumDisplaySettingsExW
GetCursorPos
GetTitleBarInfo
SendInput
EqualRect
EnableWindow
IsWindowVisible
SetWindowRgn
LockWindowUpdate
UpdateWindow
InvalidateRect
SetWindowTextW
EnableMenuItem
CheckMenuItem
SetMenuItemInfoW
UnregisterClassW
GetClassInfoExW
ShowWindow
MoveWindow
GetClientRect
SetWindowPlacement
IsZoomed
LoadCursorW
SetCursor
ModifyMenuW
GetSystemMenu
GetMenuItemInfoW
DeleteMenu
CreateMenu
InsertMenuW
AppendMenuW
PostQuitMessage
IsWindow
DestroyIcon
LoadImageW
RegisterWindowMessageW
SetRect
CopyRect
GetDesktopWindow
SetWindowPos
IntersectRect
OffsetRect
SystemParametersInfoA
GetWindowRect
GetWindowPlacement
IsIconic
GetSystemMetrics
LoadIconW
SetForegroundWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
RegisterClassExW
IsChild
CreateWindowExW
DestroyWindow
GetDlgItem
SetFocus
SetDlgItemTextW
EndDialog
CheckDlgButton
SendMessageW
PostMessageW
PostThreadMessageW
IsDialogMessageW
TranslateAcceleratorW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
RedrawWindow

msvcrt

memcpy
memcmp
_controlfp
?terminate@@YAXXZ
wcstok
realloc
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_errno
__p__commode
_XcptFilter
calloc
_callnewh
iswdigit
_ltow_s
__CxxFrameHandler3
_wcslwr_s
towlower
wcstol
iswspace
toupper
wcstombs_s
_itow_s
wcstoul
towupper
wcschr
_wcsnicmp
_vsnprintf
swscanf_s
_ftol2_sse
_ftol2
wcsstr
_wtoi
wcsrchr
wcsncmp
_wtol
wcstok_s
_wcsicmp
_purecall
wcscat_s
wcscpy_s
free
malloc
wcsncpy_s
memcpy_s
_vsnwprintf
_amsg_exit
wcsncat_s
time
gmtime
wcsftime
_CIpow
memset

shlwapi

PathFindFileNameW
StrStrIW
PathFindExtensionW
PathStripPathW
PathRemoveFileSpecW
PathAppendW
ShellMessageBoxW

ntdll

VerSetConditionMask
RtlInitString
RtlNtStatusToDosError

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification
RecordFeatureUsage
GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shcore

SHStrDupW
SHCreateMemStream

dwmapi

DwmGetWindowAttribute

wtsapi32

WTSQuerySessionInformationW
WTSOpenServerW
WTSFreeMemory
WTSCloseServer

kernel32

IsDebuggerPresent
TrySubmitThreadpoolCallback
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
InitializeCriticalSectionAndSpinCount
FindResourceW
LoadLibraryA
GetProcessId
TerminateThread
ProcessIdToSessionId
GetComputerNameW
InitOnceExecuteOnce
ExpandEnvironmentStringsW
LockResource
GetOverlappedResult
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
DisconnectNamedPipe
CreateThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
QueueUserWorkItem
ResetEvent
CreateSemaphoreW
FreeLibraryAndExitThread
GetExitCodeThread
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerExW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
WideCharToMultiByte
K32GetModuleFileNameExW
Sleep
HeapSetInformation
GetSystemDirectoryW
CreateProcessW
GetCurrentThread
GetTickCount64
WriteFile
VerifyVersionInfoW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetTempPathW
CompareStringW
SetFilePointer
GetACP
GetFullPathNameW
CreateThreadpoolTimer
CompareStringOrdinal
GetFileAttributesW
LocalAlloc
CreateDirectoryW
SearchPathW
GetCurrentDirectoryW
LocalFree
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MulDiv
lstrcmpW
GetVersionExA
GetVersionExW
ReadFile
GetFileSize
CreateFileW
GetDateFormatW
GetTimeFormatW
GetLocalTime
DeleteFileW
CreateThread
CreateEventW
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
MapViewOfFile
CreateFileMappingW
LCIDToLocaleName
UnmapViewOfFile
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
DelayLoadFailureHook
ResolveDelayLoadedAPI
InitializeCriticalSection
GetCommandLineW
GetModuleHandleExA
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
LoadLibraryExW
FreeLibrary
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
QueryPerformanceFrequency
TlsSetValue
OpenThread
TlsFree
TlsGetValue
SwitchToThread
GetSystemInfo
TlsAlloc
GetSystemTime

normaliz

IdnToAscii

Sections

.text
Size: 1008KB - Virtual size: 1007KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db9da44923bca4957b0ed72c815a22aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

shlwapi

ntdll

api-ms-win-core-featurestaging-l1-1-0

version

shcore

dwmapi

wtsapi32

kernel32

normaliz

Sections

.text Size: 1008KB - Virtual size: 1007KB

.data Size: 3KB - Virtual size: 9KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 75KB - Virtual size: 75KB

.text
Size: 1008KB - Virtual size: 1007KB

.data
Size: 3KB - Virtual size: 9KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 75KB - Virtual size: 75KB