Doctor[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Doctor.exe
Size 211KB
Sample260524-sxt73scv91
SHA256 7ea57c2fcf9ed153b9efb066a34904cba86c23b618fe73bb70e87466e76a64b5
MD5 dd6689221f3e636d76761b0c5edfd56f
SHA1 370f32cb855880bc61a4f6470ec280a9d5ee918b
SHA512 c31a163fac36a7a39cc14b0bb37df8f4252f9c638ac35ca9e6fcd16bd83ec64358cea7e65f31945b2655465a02cc66b0493f84a454b2f2a4723b10f89068ef8b
SSDEEP 3072:9ooOMSzv/tha0W6unFRPIgbQ3Qrigt8L9WDOfW2/zyv59I5Okr9uot2ySuWPTj19:9jVoaRnFRQgEArbt8JHt76Lo1q9
TLSH
T151247D10B981C032D566197649E9CFB65E2EBC618F6099CB73C00FFD4E316C1AB39B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Doctor.exe

File Explorer

Doctor.exe

.exe 211KB

Doctor.exe

IMPHASH ae0df4fe23819fe6b062d1b4217e9930
SHA256 7ea57c2fcf9ed153b9efb066a34904cba86c23b618fe73bb70e87466e76a64b5
MD5 dd6689221f3e636d76761b0c5edfd56f
SHA1 370f32cb855880bc61a4f6470ec280a9d5ee918b
SHA512 c31a163fac36a7a39cc14b0bb37df8f4252f9c638ac35ca9e6fcd16bd83ec64358cea7e65f31945b2655465a02cc66b0493f84a454b2f2a4723b10f89068ef8b
SSDEEP 3072:9ooOMSzv/tha0W6unFRPIgbQ3Qrigt8L9WDOfW2/zyv59I5Okr9uot2ySuWPTj19:9jVoaRnFRQgEArbt8JHt76Lo1q9
TLSH
T151247D10B981C032D566197649E9CFB65E2EBC618F6099CB73C00FFD4E316C1AB39B5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile

advapi32

RegCloseKey GetUserNameA RegSetValueExA RegOpenKeyExA

shell32

SHGetFolderPathA ShellExecuteA

user32

GetMessageA DispatchMessageA GetKeyboardState GetAsyncKeyState SetTimer FindWindowExA MapVirtualKeyA MessageBoxA RegisterClassA DefWindowProcA ToAscii TranslateMessage SendMessageA KillTimer PostQuitMessage CreateWindowExA

kernel32

CreateFileW HeapSize WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject ReadFile GetModuleFileNameA Process32First FindFirstFileA VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc GetDriveTypeA FindNextFileA FindClose GetModuleHandleA CreateToolhelp32Snapshot Sleep GetTickCount64 CopyFileA CreateFileA GetCurrentThread DeleteFileA Process32Next CloseHandle GetSystemInfo K32GetModuleInformation SetFileAttributesA GetLogicalDriveStringsA GetThreadContext GetProcAddress GetFileSize GlobalMemoryStatusEx WinExec IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThreadId GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SetEndOfFile WakeAllConditionVariable QueryPerformanceCounter GetSystemTimePreciseAsFileTime GetStringTypeW GetCPInfo IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EnumSystemLocalesW GetUserDefaultLCID IsValidLocale RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle WriteFile UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW

ntdll

RtlUnwind