repairit[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
repairit.exe
Size 301KB
Sample260718-vf35rsbv41
SHA256 27e95ba56ff699ebd3913388a0d3219846bb5502112c9e394fcf6b77612d7cf8
MD5 c41e9e51e1793e39db6a75dfc606333f
SHA1 7083e24ea82286c0c6e003ea9de967c856137511
SHA512 daa0ed688832b50525a0246769b7368b8d8c65355fa2760c2af631423bb22777ba3d2537cd2094088cf7dcdd01bf7ce87c75c2e01e223ca25671c6215e32e075
SSDEEP 3072:TIX/fjzsaTNGSiFEa5K3Gmgr0ldUxrL2HfXk:0PfjRT8lFlmBKL2H/k
TLSH
T13D64C75EA2FCA9ECC2524F315CE34FE359A2AC650267429715B331B407BA9837E3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
repairit.exe

File Explorer

repairit.exe

.exe 301KB

repairit.exe

IMPHASH 5fdd40220debe47c960eeec698f15886
SHA256 27e95ba56ff699ebd3913388a0d3219846bb5502112c9e394fcf6b77612d7cf8
MD5 c41e9e51e1793e39db6a75dfc606333f
SHA1 7083e24ea82286c0c6e003ea9de967c856137511
SHA512 daa0ed688832b50525a0246769b7368b8d8c65355fa2760c2af631423bb22777ba3d2537cd2094088cf7dcdd01bf7ce87c75c2e01e223ca25671c6215e32e075
SSDEEP 3072:TIX/fjzsaTNGSiFEa5K3Gmgr0ldUxrL2HfXk:0PfjRT8lFlmBKL2H/k
TLSH
T13D64C75EA2FCA9ECC2524F315CE34FE359A2AC650267429715B331B407BA9837E3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

kernel32

Sleep VirtualFree VirtualAlloc VirtualQuery GetSystemInfo GetVersion SetThreadLocale WideCharToMultiByte MultiByteToWideChar GetACP GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess GetCurrentThreadId DeleteCriticalSection InitializeCriticalSection WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteProcessMemory WriteFile VirtualAlloc UnmapViewOfFile TerminateProcess SuspendThread Sleep SizeofResource SetFilePointer ResumeThread ReadProcessMemory ReadFile OpenProcess MapViewOfFile LockResource LoadResource LoadLibraryW GetWindowsDirectoryW GetVersionExW GetTickCount GetThreadContext GetTempPathW GetProcAddress GetModuleHandleW GetFileSize GetCurrentProcess FreeResource FreeLibrary FindResourceW FindFirstFileW FindClose ExitProcess CreateProcessW CreateFileMappingW CreateFileW CompareStringW CloseHandle GetShortPathNameA GetVersionExA OpenThread

user32

SendMessageW MessageBoxA MessageBoxW LoadIconW GetSystemMetrics GetActiveWindow EnumWindows

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW GetUserNameA AdjustTokenPrivileges CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptReleaseContext CryptAcquireContextA

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree

ntdll

NtQueryInformationProcess

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

532B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

repairit.exe

oleaut32

kernel32

user32

advapi32

shell32

ole32

ntdll

generic