GotIt-Workstation-Setup[.]exe

General

Target
GotIt-Workstation-Setup.exe
Size 9KB
Sample261104-wthlnab13w
SHA256 8fdff52a7430dba14fb97239c7fe414710991f16da269374e0936a1385f3a318
MD5 3613d8d83b78ce3561680a447eb6a24a
SHA1 995eb0e883c7adebcfadd29100d810cb7f882bcd
SHA512 92161e7bc71f686c5fb0fa1bb78965e5bddff15d35ca8df9ae3fe2cdc0934b7cb5e1d47b6a5237df04d6d448cdeb2b6b74fba60e28cb55cd3d9e29cfc00cac40
SSDEEP 192:6w0dQeZ/V+m2y6AYY2zv5p2kGg23rCuEjJJREq/eN/mHPAj:Wu0kmOVtV2
TLSH
T16F12B8079FDB4063E2D60BF067F646868B7D7C133796B1EFB792D0980F9064484626B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GotIt-Workstation-Setup.exe

File Explorer

GotIt-Workstation-Setup.exe

.exe 9KB

GotIt-Workstation-Setup.exe

IMPHASH 0fc09ca2bd356182f843bacca91b7fa5
SHA256 8fdff52a7430dba14fb97239c7fe414710991f16da269374e0936a1385f3a318
MD5 3613d8d83b78ce3561680a447eb6a24a
SHA1 995eb0e883c7adebcfadd29100d810cb7f882bcd
SHA512 92161e7bc71f686c5fb0fa1bb78965e5bddff15d35ca8df9ae3fe2cdc0934b7cb5e1d47b6a5237df04d6d448cdeb2b6b74fba60e28cb55cd3d9e29cfc00cac40
SSDEEP 192:6w0dQeZ/V+m2y6AYY2zv5p2kGg23rCuEjJJREq/eN/mHPAj:Wu0kmOVtV2
TLSH
T16F12B8079FDB4063E2D60BF067F646868B7D7C133796B1EFB792D0980F9064484626B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\seld\documents\visual studio 2010\Projects\hiddeninp\Release\hiddeninp.pdb

kernel32

GetConsoleMode SetConsoleMode GetStdHandle GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

msvcp90

??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

msvcr90

_exit _encode_pointer __set_app_type _crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock __p__commode _decode_pointer _except_handler4_common _invoke_watson _controlfp_s _cexit __getmainargs _amsg_exit _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm __initenv exit _onexit _XcptFilter __p__fmode __CxxFrameHandler3

Sharing