file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

409KB
MD5

2d79aec368236c7741a6904e9adff58f
SHA1

c0b6133df7148de54f876473ba1c64cb630108c1
SHA256

b33f25c28bf15a787d41472717270301071af4f10ec93fa064c96e1a33455c35
SHA512

022c5d135f66bc253a25086a2e9070a1ae395bdedd657a7a5554563dace75e1cbfe77c87033d6908d72deeab4a53f50e8bd202c4f6d6a9f17a19a9ebfdfe9538
SSDEEP

6144:zhk7s+AfJjoF3U5w81tLffIru6t1tztD675DoRK3L9YhZmdC/0fNpZH97ndaW9:P+UJjoF3U5w8rk8LeYvR97nQW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
file.exe

Files

file.exe
.exe windows:6 windows x86 arch:x86

81961373b32efd4098659dcd8637f4f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
GetComputerNameA
GetCurrentProcess
GetDriveTypeA
GetFileInformationByHandle
GetFileSize
GetLocalTime
GetLogicalDriveStringsA
GetLogicalProcessorInformationEx
GetModuleHandleA
GetProcessHeap
GetThreadContext
GetTickCount
HeapAlloc
HeapFree
OpenProcess
RaiseException
ReadFile
ReadProcessMemory
SetFilePointer
SetThreadContext
Sleep
SystemTimeToFileTime
VirtualAlloc
VirtualAllocEx
VirtualAllocExNuma
VirtualFree
VirtualQueryEx
WaitForSingleObject
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiW
lstrcpyA
lstrlenA

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_splitpath
atexit
free
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
rand
srand
strchr
strcmp
strcpy
strcpy_s
strlen
strncpy
strstr
strtok_s

user32

CharToOemA
CloseDesktop
CreateDesktopA
GetDesktopWindow
OpenDesktopA
wsprintfA
wsprintfW

advapi32

GetCurrentHwProfileA
GetUserNameA
RegGetValueA
RegOpenKeyExA

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

shell32

SHFileOperationA
SHGetFolderPathA

ws2_32

WSACleanup
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
htons
recv
send
socket

shlwapi

PathFileExistsA
ord155

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81961373b32efd4098659dcd8637f4f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

api-ms-win-crt-runtime-l1-1-0

shell32

ws2_32

shlwapi

Sections

.text Size: 276KB - Virtual size: 276KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 41KB - Virtual size: 2.1MB

.00cfg Size: 512B - Virtual size: 4B

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 276KB - Virtual size: 276KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 41KB - Virtual size: 2.1MB

.00cfg
Size: 512B - Virtual size: 4B

.reloc
Size: 36KB - Virtual size: 35KB