stage2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stage2.exe
Size 159KB
Sample260913-amnnface94
SHA256 e5fc0f0dfb59c74becbf397bbee196828e3750d9ea99cfb524f60bc4dd65deaa
MD5 dc22d7ce4e0bbc578af081235238f811
SHA1 b4ae0e760e3359b110e56ac4dff587a27039ae14
SHA512 5d90e950b10643248a7c76b9cb50ebd80ac1a676b39c0db9fc5bc2e143799e02db962970209eafa1d6f8f582673730a5f3e05af57865a6decf6fe0e19650109c
SSDEEP 3072:ZPwYk84EuL0tp5hmlI7TfTGgtwSmiImUMDR:UxgtYITGgtwAUMDR
TLSH
T1DDF33B1B735394FECA17807486AF9371EA32F82513209A3F2B55DF325E31D605E9EA24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage2.exe

File Explorer

stage2.exe

.exe 159KB

stage2.exe

IMPHASH 132c0567aba8006e80ba6c8ec415da05
SHA256 e5fc0f0dfb59c74becbf397bbee196828e3750d9ea99cfb524f60bc4dd65deaa
MD5 dc22d7ce4e0bbc578af081235238f811
SHA1 b4ae0e760e3359b110e56ac4dff587a27039ae14
SHA512 5d90e950b10643248a7c76b9cb50ebd80ac1a676b39c0db9fc5bc2e143799e02db962970209eafa1d6f8f582673730a5f3e05af57865a6decf6fe0e19650109c
SSDEEP 3072:ZPwYk84EuL0tp5hmlI7TfTGgtwSmiImUMDR:UxgtYITGgtwAUMDR
TLSH
T1DDF33B1B735394FECA17807486AF9371EA32F82513209A3F2B55DF325E31D605E9EA24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreateFileA CreateProcessA CreateSemaphoreW DeleteCriticalSection DeleteFileA EnterCriticalSection FreeLibrary GetConsoleWindow GetCurrentThreadId GetFileSize GetLastError GetModuleHandleW GetProcAddress GetStartupInfoA GetTempPathA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar RaiseException ReadFile ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _onexit abort calloc exit fprintf fputc fputs free fwrite localeconv malloc memchr memcmp memcpy memmove memset realloc signal strcmp strerror strlen strncmp vfprintf wcslen _write _read _close

user32

ShowWindow

Name

.text

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stage2.exe

kernel32

msvcrt

user32

generic