Order Form[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Order Form.exe
Size 2.6MB
Sample220620-dafc3seed9
SHA256 4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21
MD5 f7ad1a2e8f73eeed6cbab48a129b3c6e
SHA1 f198282b667cebd73ac44086438ec3af6382daa5
SHA512 747967fee8647312d1fad1967be3c843dacdb4993a3fd246b0001f9093610e0e167b6807300fd050403c6dd810e63c13c2245cc2966ca6d9d1a5f6c301ac1382
SSDEEP 12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YeD4pa7+ougoC:5vx1LtWvhhIYm1fJP/DlHx
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

Order Form.exe

.exe 2.6MB

Order Form.exe

IMPHASH 4d40121bda2ea8ecb7b1bb1a71138d3e
SHA256 4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21
MD5 f7ad1a2e8f73eeed6cbab48a129b3c6e
SHA1 f198282b667cebd73ac44086438ec3af6382daa5
SHA512 747967fee8647312d1fad1967be3c843dacdb4993a3fd246b0001f9093610e0e167b6807300fd050403c6dd810e63c13c2245cc2966ca6d9d1a5f6c301ac1382
SSDEEP 12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YeD4pa7+ougoC:5vx1LtWvhhIYm1fJP/DlHx
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

4276

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetNativeSystemInfo GetOEMCP GetProcessHandleCount GetProcessHeaps GetProcessId GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersion GetVersionExW GetWindowsDirectoryW HeapCreate HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile FlushViewOfFile OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus ProcessIdToSessionId QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache HeapQueryInformation HeapValidate InterlockedFlushSList FormatMessageA FlushFileBuffers FindNextFileW FindFirstFileExW FindClose FileTimeToSystemTime ExpandEnvironmentStringsW ExitProcess EnumSystemLocalesW EnumSystemLocalesEx DisconnectNamedPipe DuplicateHandle DeleteFileW DebugBreak CreateThread CreateSemaphoreW CreateRemoteThread CreateProcessW CreateNamedPipeW CreateMutexW CreateJobObjectW CreateIoCompletionPort CreateFileW CreateFileMappingW CreateEventW CreateDirectoryW ConnectNamedPipe CompareStringW CloseHandle AssignProcessToJobObject AcquireSRWLockExclusive VirtualProtect VirtualAlloc GetCurrentThreadId Sleep SetThreadLocale GetThreadLocale WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer MoveFileW EncodePointer GetConsoleOutputCP

user32

GetThreadDesktop GetProcessWindowStation GetMessageW FindWindowExW DispatchMessageW DestroyWindow DefWindowProcW CreateWindowStationW CreateWindowExW CreateDesktopW CloseWindowStation CloseDesktop AllowSetForegroundWindow SetWindowLongA GetUserObjectInformationW ClientToScreen MessageBoxA GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC TrackPopupMenuEx GetSubMenu DestroyMenu LoadMenuA GetWindowThreadProcessId UnregisterClassA CharNextA PostMessageW RegisterClassW SendMessageTimeoutW SetProcessDPIAware SetProcessWindowStation TranslateMessage UnregisterClassW EndDialog GetDlgItem SetDlgItemTextA GetDlgItemTextA EnableWindow FillRect KillTimer SetTimer GetFocus GetActiveWindow DialogBoxParamA SetWindowPos IsChild IsWindow SendMessageA PeekMessageA CharNextW

advapi32

ConvertSidToStringSidW RegQueryInfoKeyA RegOpenKeyExA RegDeleteKeyA RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWrite FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 AccessCheck

ole32

CoCreateInstance StringFromGUID2

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

oleaut32

SysAllocString UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysFreeString

shlwapi

PathMatchSpecW

gdi32

CreateCompatibleDC CreatePalette CreateSolidBrush DeleteDC DeleteObject RealizePalette SelectObject SelectPalette CreateDIBSection BitBlt

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime

Name

.text

Size

785KB

Virtual Size

784KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ