findit_dbg[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
findit_dbg.exe
Size 2.6MB
Sample261006-zyfjmsgz6r
SHA256 256fda1c4a7e88490de581462a97dafb5e31575a93f77787c681dfe15a4b2769
MD5 d1fde5a48dca306e34c37d5031e955e3
SHA1 34df209da0d5e575d21decf3ef0fdb29068d8279
SHA512 fadf1548303775627452727d88f0a0c3f50b50173d2649564fc04ec7d4b74c5816587d740204c371ac2bd004ad18d6755c8dbc3ddb035f2a4d2bdff7a28db6ad
SSDEEP 24576:vANzRLD8HwTlVXrIfeLL94mnEdCRoSQtPXMWOkN31NjZT:4Nz9D8Qnsfe6lCRoSQ0M31NjZT
TLSH
T12DC51903778A6DE6CCD32BB4AADF133D9721EE305F694B7B85488234CC432D99D1A691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
findit_dbg.exe

File Explorer

findit_dbg.exe

.exe 2.6MB

findit_dbg.exe

IMPHASH c58d1d2a7fa118de9bf3eeb895fbb88f
SHA256 256fda1c4a7e88490de581462a97dafb5e31575a93f77787c681dfe15a4b2769
MD5 d1fde5a48dca306e34c37d5031e955e3
SHA1 34df209da0d5e575d21decf3ef0fdb29068d8279
SHA512 fadf1548303775627452727d88f0a0c3f50b50173d2649564fc04ec7d4b74c5816587d740204c371ac2bd004ad18d6755c8dbc3ddb035f2a4d2bdff7a28db6ad
SSDEEP 24576:vANzRLD8HwTlVXrIfeLL94mnEdCRoSQtPXMWOkN31NjZT:4Nz9D8Qnsfe6lCRoSQ0M31NjZT
TLSH
T12DC51903778A6DE6CCD32BB4AADF133D9721EE305F694B7B85488234CC432D99D1A691
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle CreateEventA DeleteCriticalSection EnterCriticalSection FormatMessageA FreeConsole FreeLibrary GetComputerNameA GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fflush fputc fputs fwrite setvbuf _read

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp wcslen

api-ms-win-crt-utility-l1-1-0

rand_s

user32

MessageBoxA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

356KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

findit_dbg.exe

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

winhttp

generic