agent[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
agent.exe
Size 149KB
Sample260804-c3fc4sep4y
SHA256 77cbadd5f796cb7daac1d95a9028d9c8d8354a403a31ecbee1487c2faa011fcc
MD5 130b2f265884eb83deabd5c3b5aed4fe
SHA1 b885d110de53dfd6a69a188ecb28b85d3935b68f
SHA512 a134b0d8a1e38f98c4508ce5810eb454d665a0a1589fb144b968428a53ff119663587afca93ce0f98eab5ec1886de639f8f6d38e9043070f6e2a6fa4b962351b
SSDEEP 1536:Kbjw13N0+4fsZ5XV3yOWD17HxvI6goE5lSSfSgsc2oNO2:Kg1maX3yPDFH1I6EJcoNO2
TLSH
T184E382E127CA0CE6FAD2237C65C3D2356A3CFDE1CE164B5B4654A1312A43AC47B9731A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent.exe

File Explorer

agent.exe

.exe 149KB

agent.exe

IMPHASH 558e64ed67ac66b796d1b096741533fa
SHA256 77cbadd5f796cb7daac1d95a9028d9c8d8354a403a31ecbee1487c2faa011fcc
MD5 130b2f265884eb83deabd5c3b5aed4fe
SHA1 b885d110de53dfd6a69a188ecb28b85d3935b68f
SHA512 a134b0d8a1e38f98c4508ce5810eb454d665a0a1589fb144b968428a53ff119663587afca93ce0f98eab5ec1886de639f8f6d38e9043070f6e2a6fa4b962351b
SSDEEP 1536:Kbjw13N0+4fsZ5XV3yOWD17HxvI6goE5lSSfSgsc2oNO2:Kg1maX3yPDFH1I6EJcoNO2
TLSH
T184E382E127CA0CE6FAD2237C65C3D2356A3CFDE1CE164B5B4654A1312A43AC47B9731A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits GetObjectA SelectObject

kernel32

DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageW GetLastError GetLocalTime GetModuleHandleW GetProcAddress GetStartupInfoA InitializeCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _initterm _ismbblead free memcmp memcpy memmove memset _onexit _pclose _popen _vscprintf _vsnprintf abort calloc exit fgets fprintf fwrite getenv malloc signal strlen strncmp vfprintf wcstombs

user32

ExitWindowsEx GetDC GetSystemMetrics MessageBoxA ReleaseDC SetCursorPos VkKeyScanA keybd_event mouse_event

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send socket

libgcc_s_seh-1

_Unwind_Resume

libstdc++-6

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13get_allocatorEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4dataEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcy _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4sizeEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5emptyEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEPKcy _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6substrEyy _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7_M_dataEv _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8capacityEv _ZNKSt9basic_iosIcSt11char_traitsIcEE5rdbufEv _ZNKSt9basic_iosIcSt11char_traitsIcEEcvbEv _ZNKSt9basic_iosIcSt11char_traitsIcEEntEv _ZNSirsERi _ZNSo5writeEPKcx _ZNSolsEPFRSoS_E _ZNSt14basic_ifstreamIcSt11char_traitsIcEE5closeEv _ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode _ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev _ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv _ZNSt14basic_ofstreamIcSt11char_traitsIcEE7is_openEv _ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode _ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode _ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev _ZNSt15basic_streambufIcSt11char_traitsIcEE5sgetcEv _ZNSt15basic_streambufIcSt11char_traitsIcEE6sbumpcEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE11_M_capacityEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_Alloc_hiderC1EPcRKS3_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13_M_local_dataEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13_M_set_lengthEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13_S_copy_charsEPcPKcS7_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE3endEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4backEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5beginEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKcy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6insertEyPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6insertEyRKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7_M_dataEPc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8pop_backEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS3_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEOS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEixEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEc _ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEC1ERKNS_12basic_stringIcS2_S3_EESt13_Ios_Openmode _ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEED1Ev _ZSt17__throw_bad_allocv _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_ _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc _ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZStrsIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZdlPvy _Znwy __cxa_begin_catch __cxa_end_catch __cxa_rethrow __gxx_personality_seh0

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

agent.exe

gdi32

kernel32

msvcrt

user32

wininet

ws2_32

libgcc_s_seh-1

libstdc++-6

generic