IMTKiller[.]V1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IMTKiller.V1.exe
Size 429KB
Sample260808-mhc3csvdph
SHA256 8c2cb505f5fcf908a3d28945d4556f3fe3b42bdbc0f58db2015417cd1116fa39
MD5 d3940cd71fff8fe22047f1e1512d181a
SHA1 bf32993ee1656fb833372b09bb14fbfe3bd0e892
SHA512 19a3d31dd08a6fbb8e46bbf4bdc082ea475c0c4a40f702f27210053aad025ed6f12c925a6c7de750d20436b274de1eea2afef6dcbfbc38a13fe8090991db50ea
SSDEEP 12288:ZEU2YuIQ3XrBWKLZdxt5ln8g6NCyoX2nTS+TBGOyG:ZrvuIQ3dWKtdxtX9fXuTBGOyG
TLSH
T153948EC6B7C6ADE6C10185368DAB43593338F6E116978B07292C72341E17AF1FE8B617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IMTKiller.V1.exe

File Explorer

IMTKiller.V1.exe

.exe 429KB

IMTKiller.V1.exe

IMPHASH fb8fdb43fc1d3362c698ebbc6403dcc0
SHA256 8c2cb505f5fcf908a3d28945d4556f3fe3b42bdbc0f58db2015417cd1116fa39
MD5 d3940cd71fff8fe22047f1e1512d181a
SHA1 bf32993ee1656fb833372b09bb14fbfe3bd0e892
SHA512 19a3d31dd08a6fbb8e46bbf4bdc082ea475c0c4a40f702f27210053aad025ed6f12c925a6c7de750d20436b274de1eea2afef6dcbfbc38a13fe8090991db50ea
SSDEEP 12288:ZEU2YuIQ3XrBWKLZdxt5ln8g6NCyoX2nTS+TBGOyG:ZrvuIQ3dWKtdxtX9fXuTBGOyG
TLSH
T153948EC6B7C6ADE6C10185368DAB43593338F6E116978B07292C72341E17AF1FE8B617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ChangeServiceConfigA CloseServiceHandle ControlService DeleteService GetTokenInformation InitializeSecurityDescriptor OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegDeleteKeyExA RegDeleteValueA RegEnumValueA RegOpenKeyExA RegSetKeySecurity RegSetValueExA SetSecurityDescriptorDacl

kernel32

CloseHandle CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FlushConsoleInputBuffer GetCurrentProcess GetFileAttributesA GetLastError GetLocalTime GetModuleFileNameA GetStdHandle InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar OpenProcess Process32First Process32Next RemoveDirectoryA SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleA SetFileAttributesA SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _stricmp _unlock abort calloc exit fclose fflush fopen fprintf fputc free fwrite getc getchar getenv isspace isxdigit localeconv malloc memcpy memset putchar realloc signal strcmp strerror strlen strncmp strstr strtol strtoul system tolower ungetc vfprintf wcslen _strtoui64 _strtoi64

shell32

ShellExecuteA

shlwapi

SHDeleteKeyA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

Name

.text

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IMTKiller.V1.exe

advapi32

kernel32

msvcrt

shell32

shlwapi

wininet

generic