cf4f5604691ccda71f2d54177fca4c7c25d921cffa303dd0e43fac855837967e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2033-Dec-06 04:36:23
Detected languages English - United States
Debug artifacts ping.pdb
CompanyName Microsoft Corporation
FileDescription TCP/IP Ping Command
FileVersion 10.0.26100.7920 (WinBuild.160101.0800)
InternalName ping.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ping.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.26100.7920

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • c2-example.com
  • evil-c2-example.com
  • example.com
  • http://evil-c2-example.com
Suspicious The PE is possibly packed. Unusual section name found: fothk
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegQueryValueExW
  • RegOpenKeyExW
  • RegCloseKey
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Suspicious The file contains overlay data. 127 bytes of data starting at offset 0xb000.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 ee271ac894cb7e6f91ee3a9b75920221 🔍
SHA1 8686cfc02fc06f347c3b02d09c86fee1818df596 🔍
SHA256 cf4f5604691ccda71f2d54177fca4c7c25d921cffa303dd0e43fac855837967e 🔍
SHA3 fe593621769d31cd4349671d861ef3ee888423578091fa382e0dcc191bba160a 🔍
SSDeep 384:ieBxwyCtsjQcS37zDx91AzyzZyxVOSgA8XE8of0UcLT+N72WBlW9:X58cS37zDxYyFkVIJUpf0UcLTQ75S 🔍
Imports Hash 9dddbb964513ce08e2ac4b23405ce7e6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2033-Dec-06 04:36:23
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x4000
SizeOfInitializedData 0x7000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001300 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0xc000
SizeOfHeaders 0x1000
Checksum 0xdc09
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x80000
SizeofStackCommit 0x2000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 19c676be750ad8736adb312320f7c652 🔍
SHA1 d82ba7570ef075f7d42d5c595cd5e2a9e9c5072b 🔍
SHA256 f0583f19489e99ca17965554146f014f80d65ad6f0f95aa38209f82a07e2435b 🔍
SHA3 c70dffc199188e258037fe1ce58a09efcb6489d9a43223407ceb920bcce77499 🔍
VirtualSize 0x2c70
VirtualAddress 0x1000
SizeOfRawData 0x3000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.90989

fothk

MD5 0bd9f9424286b1137897dff14b776c45 🔍
SHA1 afaf2627298800b2ee5efe1324a01803755f07fb 🔍
SHA256 b71b6b1f33cd3af35bc90a0742c20181be19fd06fd231729bfe996c7bcfd83d8 🔍
SHA3 f177c07fafabd6077994bd7da3edb1c02a6ca1a3a9ac55cb79163d5cd366a18d 🔍
VirtualSize 0x1000
VirtualAddress 0x4000
SizeOfRawData 0x1000
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0.0159202

.rdata

MD5 0d69f07ee298f652a5c43151605a19fe 🔍
SHA1 a7fec1a4eb4cf56fb3260a24b890c665c8b83f35 🔍
SHA256 1c356cc49cb227d0c886e4d964eb707a24d8df635a9c83e2a068c8369a9cbdd3 🔍
SHA3 f256e54c5dfaac4598722e97ac1aa13e3d56b9d9d208d167a4b8daa5005fbcfb 🔍
VirtualSize 0x1674
VirtualAddress 0x5000
SizeOfRawData 0x2000
PointerToRawData 0x5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.22422

.data

MD5 17a7c492501b56fbb171921c6d504f4f 🔍
SHA1 62ef8ab84fb97fe2e952008169a375c479c80cb2 🔍
SHA256 28c8bb26c68c489a6462380b50c9fe918feef78ee2f5d451eba510e7d7d68299 🔍
SHA3 e2f38bff5e8621d3b71630df7a66c389e3b77309c08a24fb5d21a4d4f4aad719 🔍
VirtualSize 0x1a40
VirtualAddress 0x7000
SizeOfRawData 0x1000
PointerToRawData 0x7000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.272572

.pdata

MD5 5ceadfee6dd7dcadcde042020f578a31 🔍
SHA1 c92884efc762e38c0cd2d55654f31b07ca2e6a7f 🔍
SHA256 1ed7ae8cac3d8a2624f626772989437bf64cf7333042a118c69443f5cb87d951 🔍
SHA3 529ad0f9a7afc4f01add698165588fccedadd2b416580ce3c989b39230ad3bc3 🔍
VirtualSize 0x1b0
VirtualAddress 0x9000
SizeOfRawData 0x1000
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.603132

.rsrc

MD5 27ea983c2e6a3656f8cdeaba9e400ac9 🔍
SHA1 4e259dc232496f2cbe7aacb3f26ecef9d6af339a 🔍
SHA256 ed523a17c9a6845ca339dc30a2cb5f15999a4a5f5c25e0a77de212cf0ed23306 🔍
SHA3 76069650458528f58d7f842ccc68b6f69f56efc4701bf84cc6f1447cd9e8190f 🔍
VirtualSize 0x820
VirtualAddress 0xa000
SizeOfRawData 0x1000
PointerToRawData 0x9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.6427

.reloc

MD5 d55a603724f867e20d57bce40b50a6c8 🔍
SHA1 f7827b260a069e430f373cf96832d1174afc7603 🔍
SHA256 1c39ff29fb9cd69222610ade911b1784c9307af103fd4bcdfc147bbfea0bf17c 🔍
SHA3 16dc5c5c891cd6ca0281c273b9a8ca0bbe426d131f93bd26ea75c17d981fe521 🔍
VirtualSize 0x88
VirtualAddress 0xb000
SizeOfRawData 0x1000
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.180817

Imports

msvcrt.dll wcschr
fgetpos
__wgetmainargs
wcstoul
iswctype
__iob_func
_cexit
__setusermatherr
_initterm
_setmode
__C_specific_handler
_write
_fileno
fflush
exit
_wcsicmp
_XcptFilter
_fmode
_get_osfhandle
memcpy
__set_app_type
fwprintf
_exit
_amsg_exit
?terminate@@YAXXZ
_commode
memset
api-ms-win-core-console-l1-1-0.dll SetConsoleCtrlHandler
GetConsoleMode
api-ms-win-core-registry-l1-1-0.dll RegQueryValueExW
RegOpenKeyExW
RegCloseKey
IPHLPAPI.DLL IcmpSendEcho2Ex
GetIpForwardTable
IcmpCreateFile
IcmpCloseHandle
SetCurrentThreadCompartmentId
Icmp6CreateFile
GetIpErrorString
Icmp6SendEcho2
api-ms-win-core-localization-l1-2-0.dll SetThreadUILanguage
FormatMessageW
api-ms-win-core-processenvironment-l1-1-0.dll GetEnvironmentVariableW
WS2_32.dll InetNtopW
WSAStartup
GetAddrInfoW
WSACleanup
FreeAddrInfoW
GetNameInfoW
api-ms-win-core-heap-l2-1-0.dll LocalFree
LocalAlloc
api-ms-win-core-synch-l1-2-0.dll Sleep
api-ms-win-core-errorhandling-l1-1-0.dll SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
ntdll.dll RtlIpv4StringToAddressW
api-ms-win-core-heap-l1-1-0.dll HeapSetInformation
api-ms-win-core-string-l1-1-0.dll WideCharToMultiByte
api-ms-win-core-file-l1-1-0.dll GetFileType
api-ms-win-core-rtlsupport-l1-1-0.dll RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0.dll TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-libraryloader-l1-2-0.dll GetModuleHandleW
api-ms-win-core-profile-l1-1-0.dll QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0.dll GetSystemTimeAsFileTime
GetTickCount

Delayed Imports

1

Type MUI
Language English - United States
Codepage UNKNOWN
Size 0xc8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.75946
MD5 af65255910666a279c75a748fdd12560 🔍
SHA1 502abddcb9cbbcc03e8fd40e2f96c9a6bad32fc7 🔍
SHA256 0f280568bb7b227443cca00b5ef74bb6afea56727d342006349bddf1bd9721c1 🔍
SHA3 107adecfcf72e2edea7f36df150d8ac08c3afbf5d674a3fa853217af16db612f 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x38c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.50606
MD5 e938b88a7b96b34acb795787738fb57b 🔍
SHA1 2069732a45973d31857e088ee3dc0cfc441e98d1 🔍
SHA256 a8c650ef1effac334e798d73fc91f15184695128ebc02669de7021bdb69fffd7 🔍
SHA3 7a10ab461db5f45641722be6cf01cc2ebd447b339965606cd49032a0675c6899 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2d3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.92164
MD5 8d33b7f04d680c94fde649bd9fcd30cb 🔍
SHA1 21f0d3a4cf86f5fcd9fc49958657d7c32e84e940 🔍
SHA256 02f259d9e9f1e4937afe0d3eadbc1a9bbc2b156f628a463560fea15c9ba8c854 🔍
SHA3 7b9e483e0866282acba4738332665e99f02cf2e01960d7296e69609b25de8e12 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.26100.7920
ProductVersion 10.0.26100.7920
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Microsoft Corporation
FileDescription TCP/IP Ping Command
FileVersion (#2) 10.0.26100.7920 (WinBuild.160101.0800)
InternalName ping.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ping.exe
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.26100.7920
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2033-Dec-06 04:36:23
Version 0.0
SizeofData 33
AddressOfRawData 0x56f0
PointerToRawData 0x56f0
Referenced File ping.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2033-Dec-06 04:36:23
Version 0.0
SizeofData 556
AddressOfRawData 0x5714
PointerToRawData 0x5714

UNKNOWN

Characteristics 0
TimeDateStamp 2033-Dec-06 04:36:23
Version 0.0
SizeofData 36
AddressOfRawData 0x5968
PointerToRawData 0x5968

UNKNOWN (#2)

Characteristics 0
TimeDateStamp 2033-Dec-06 04:36:23
Version 0.0
SizeofData 4
AddressOfRawData 0x598c
PointerToRawData 0x598c

TLS Callbacks

Load Configuration

Size 0x148
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140007040
GuardCFCheckFunctionPointer 5368730656
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xd196f9fd
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 36
C++ objects (33145) 2
Unmarked objects (#2) 1
ASM objects (33145) 4
C objects (33145) 20
Total imports 74
Imports (33145) 3
C objects (LTCG) (33145) 2
Resource objects (33145) 1
Linker (33145) 1

Errors

Leave a comment

No comments yet.