masscan64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
masscan64.exe
Size 394KB
Sample260825-vbzlsaaa47
SHA256 174f91806e8bc1c0dea24192f7d4afcefc40a1731827b32939d4f411e8402d75
MD5 01801464ac43a44c489cc00d4d25162c
SHA1 0e9be7359d8fde01199c04c1113b1e9272c93294
SHA512 c657cd51e58ca8b2ff748e168272ffa3909e98a976acc33965f0b2946fdff3c3ad5720bc529b284eb9a922f8f33691c5d44e8e8c8f3237b3a960f4d678227aca
SSDEEP 6144:lBQ5pksLlbQ5ZiuqQ2rqJ0vPyQzAzAMtt1/lwdnfwBq1wD/wd:lBQ5pLioRfiQS/7pmwD
TLSH
T13E848C56F31914F9D297803A4563D202F376F859034256EF3AAD86241F26BE1BE3BF81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
masscan64.exe

File Explorer

masscan64.exe

.exe 394KB

masscan64.exe

IMPHASH fcd28fe80c6b80a2113a57cee3ddd0e0
SHA256 174f91806e8bc1c0dea24192f7d4afcefc40a1731827b32939d4f411e8402d75
MD5 01801464ac43a44c489cc00d4d25162c
SHA1 0e9be7359d8fde01199c04c1113b1e9272c93294
SHA512 c657cd51e58ca8b2ff748e168272ffa3909e98a976acc33965f0b2946fdff3c3ad5720bc529b284eb9a922f8f33691c5d44e8e8c8f3237b3a960f4d678227aca
SSDEEP 6144:lBQ5pksLlbQ5ZiuqQ2rqJ0vPyQzAzAMtt1/lwdnfwBq1wD/wd:lBQ5pLioRfiQS/7pmwD
TLSH
T13E848C56F31914F9D297803A4563D202F376F859034256EF3AAD86241F26BE1BE3BF81
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

281500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jj\Desktop\masscan-master\bin\masscan.pdb

kernel32

LoadLibraryA GetProcAddress CreateFileA GetProcessAffinityMask WaitForSingleObject GetLastError Sleep QueryPerformanceFrequency QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetCurrentProcess GetSystemTimeAsFileTime GetModuleFileNameA GetModuleHandleW

ws2_32

connect htonl recv send htons select getservbyport getprotobynumber socket WSAStartup

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

vcruntime140

strstr __C_specific_handler __current_exception __current_exception_context memset memcpy strchr strrchr memmove memcmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode fwrite __stdio_common_vfprintf _fseeki64 __stdio_common_vsprintf fseek fopen ftell __p__commode fread _ftelli64 fopen_s __stdio_common_vsprintf_s _getcwd fgets fclose __acrt_iob_func _open_osfhandle fflush

api-ms-win-crt-time-l1-1-0

strftime _gmtime64_s clock _mktime64 _localtime64_s _time64

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode free calloc

api-ms-win-crt-string-l1-1-0

strcpy_s isalnum isalpha _strnicmp isspace isdigit isxdigit tolower ispunct _memicmp toupper strcmp isprint _strdup

api-ms-win-crt-runtime-l1-1-0

signal _register_onexit_function _errno _initialize_onexit_table _beginthread exit perror _register_thread_local_exe_atexit_callback terminate _c_exit _cexit __p___argv _crt_atexit abort __p___argc _exit _seh_filter_exe strerror _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-convert-l1-1-0

atoi strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrt _fdopen

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 rename _access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale