align_bot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
align_bot.exe
Size 696KB
Sample261006-wctycssxht
SHA256 bc2351ee0e20f89b54eb84ae3b8c6bba5e5db4495478661c9658ddee9c45a983
MD5 d45de4b73ac79c3789578debc0a4b3f1
SHA1 7b603a2096d66c549db6e4127c87959a1a032f10
SHA512 c26e595d36b5128a6569a64d21c4ac8ff2895480d3d6b178b6612f230b5f2c9013bbe896a12ba1f4ce90df3fc01e7ec9aea6b35847022bfe9e197be3ecd5863d
SSDEEP 6144:6UGMXzFwpkNYfKvk+vore+vs1a0XyfuWrO12YMsXKZ:6UzzFReKvk+grVs1bLpf5XK
TLSH
T1E5E47E033F405B7CE5428339B161C463E531BE643A69F2B74FE6A93A0B576D00B64F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
align_bot.exe

File Explorer

align_bot.exe

.exe 696KB

align_bot.exe

IMPHASH 3b414238f081a30ec836ddd16b829732
SHA256 bc2351ee0e20f89b54eb84ae3b8c6bba5e5db4495478661c9658ddee9c45a983
MD5 d45de4b73ac79c3789578debc0a4b3f1
SHA1 7b603a2096d66c549db6e4127c87959a1a032f10
SHA512 c26e595d36b5128a6569a64d21c4ac8ff2895480d3d6b178b6612f230b5f2c9013bbe896a12ba1f4ce90df3fc01e7ec9aea6b35847022bfe9e197be3ecd5863d
SSDEEP 6144:6UGMXzFwpkNYfKvk+vore+vs1a0XyfuWrO12YMsXKZ:6UzzFReKvk+grVs1bLpf5XK
TLSH
T1E5E47E033F405B7CE5428339B161C463E531BE643A69F2B74FE6A93A0B576D00B64F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FlsAlloc FlsFree FlsSetValue FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

188KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

25KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

459KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

align_bot.exe

api-ms-win-core-synch-l1-2-0

kernel32

msvcrt

ntdll

generic