New_[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
New_.exe
Size 2.6MB
Sample220620-k7cf1sbgfl
SHA256 9d2aeb602bc3f0bc7b42932f1cd2f511f7c17a107049da2f0a8a563f60c60124
MD5 c05194a34faeb51eea77515249534d10
SHA1 d24a2549c3bbb23e6b8899831be4d9e9b44c496b
SHA512 fce62a1ce62c37b9f776daf1b0e0629330d53dc75a3a47d9c277fa9ec5af91ff82e1e34398678ec68c7cef44a7380c77878a775a83f9e35b1b1561c2f0ba8d72
SSDEEP 12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YFD4pa7+ougoC:5vx1LtWvhhIYm1fJP/Dlax
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

New_.exe

.exe 2.6MB

New_.exe

IMPHASH 4d40121bda2ea8ecb7b1bb1a71138d3e
SHA256 9d2aeb602bc3f0bc7b42932f1cd2f511f7c17a107049da2f0a8a563f60c60124
MD5 c05194a34faeb51eea77515249534d10
SHA1 d24a2549c3bbb23e6b8899831be4d9e9b44c496b
SHA512 fce62a1ce62c37b9f776daf1b0e0629330d53dc75a3a47d9c277fa9ec5af91ff82e1e34398678ec68c7cef44a7380c77878a775a83f9e35b1b1561c2f0ba8d72
SSDEEP 12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YFD4pa7+ougoC:5vx1LtWvhhIYm1fJP/Dlax
MD5 SHA1 SHA512 SSDEEP

Minor OS version

Major OS version

Entry point

4276

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetNativeSystemInfo GetOEMCP GetProcessHandleCount GetProcessHeaps GetProcessId GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersion GetVersionExW GetWindowsDirectoryW HeapCreate HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile FlushViewOfFile OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus ProcessIdToSessionId QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache HeapQueryInformation HeapValidate InterlockedFlushSList FormatMessageA FlushFileBuffers FindNextFileW FindFirstFileExW FindClose FileTimeToSystemTime ExpandEnvironmentStringsW ExitProcess EnumSystemLocalesW EnumSystemLocalesEx DisconnectNamedPipe DuplicateHandle DeleteFileW DebugBreak CreateThread CreateSemaphoreW CreateRemoteThread CreateProcessW CreateNamedPipeW CreateMutexW CreateJobObjectW CreateIoCompletionPort CreateFileW CreateFileMappingW CreateEventW CreateDirectoryW ConnectNamedPipe CompareStringW CloseHandle AssignProcessToJobObject AcquireSRWLockExclusive VirtualProtect VirtualAlloc GetCurrentThreadId Sleep SetThreadLocale GetThreadLocale WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer MoveFileW EncodePointer GetConsoleOutputCP

user32

GetThreadDesktop GetProcessWindowStation GetMessageW FindWindowExW DispatchMessageW DestroyWindow DefWindowProcW CreateWindowStationW CreateWindowExW CreateDesktopW CloseWindowStation CloseDesktop AllowSetForegroundWindow SetWindowLongA GetUserObjectInformationW ClientToScreen MessageBoxA GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC TrackPopupMenuEx GetSubMenu DestroyMenu LoadMenuA GetWindowThreadProcessId UnregisterClassA CharNextA PostMessageW RegisterClassW SendMessageTimeoutW SetProcessDPIAware SetProcessWindowStation TranslateMessage UnregisterClassW EndDialog GetDlgItem SetDlgItemTextA GetDlgItemTextA EnableWindow FillRect KillTimer SetTimer GetFocus GetActiveWindow DialogBoxParamA SetWindowPos IsChild IsWindow SendMessageA PeekMessageA CharNextW

advapi32

ConvertSidToStringSidW RegQueryInfoKeyA RegOpenKeyExA RegDeleteKeyA RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid EventRegister EventUnregister EventWrite FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 AccessCheck

ole32

CoCreateInstance StringFromGUID2

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

oleaut32

SysAllocString UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringLen SysFreeString

shlwapi

PathMatchSpecW

gdi32

CreateCompatibleDC CreatePalette CreateSolidBrush DeleteDC DeleteObject RealizePalette SelectObject SelectPalette CreateDIBSection BitBlt

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime

Name

.text

Size

785KB

Virtual Size

784KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ