Tuke[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Tuke.exe
Size

316KB
MD5

af6c5c17b88a0bee8d0290b75a4a5c2e
SHA1

bbdf0e0176017b6d950d262671b874b50cce3b37
SHA256

c268b36e43ccc528b8d144913d2f0630e51d1e1d1858904d04b0d2e6dc3bc173
SHA512

0211751db6167b421fc68d8273fa9a635a244933df01bd6004136408339ea62d70607e5e2d8b25a466fef9d5e3fd13b5184962436541a129a8d15d69bbcb830a
SSDEEP

6144:ze1+pE7vfQXa1N4VNEVzRK1w1sxWon5aA0QHW:zeEovfEa1eMron9

Score

N/A

Malware Config

Signatures

Files

Tuke.exe
.exe windows x64

7b6718ce1cf36de828a101a27dce53ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d9

Direct3DCreate9

kernel32

MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
CreateThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CloseHandle
OpenProcess
IsProcessorFeaturePresent
Module32First
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
Module32Next
GetConsoleWindow
InitializeSListHead

user32

GetCapture
ScreenToClient
UpdateWindow
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
DefWindowProcA
CreateWindowExA
TranslateMessage
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
ClientToScreen
ShowWindow
IsChild
TrackMouseEvent
SetCapture
SetCursor
GetClientRect
ReleaseCapture
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
SendMessageA
SendInput
GetAsyncKeyState
FindWindowA
GetForegroundWindow
GetClassLongPtrW
GetWindowThreadProcessId
GetCursorPos
SetCursorPos
LoadCursorA

msvcp140

?_Random_device@std@@YAIXZ
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z

ntdll

ZwReadVirtualMemory
ZwQueryVirtualMemory
ZwWriteVirtualMemory

winmm

PlaySoundA

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
memchr
strstr
memset
memcmp
memcpy
memmove

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_initialize_narrow_environment
_crt_atexit
__p___argc
_exit
__p___argv
_initterm_e
_initterm
_cexit
_configure_narrow_argv
_get_initial_narrow_environment
terminate
exit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vsprintf
fclose
fseek
fread
fflush
__p__commode
ftell
_wfopen
_set_fmode
fwrite

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

fmodf
cosf
ceilf
__setusermatherr
roundf
acosf
sinf
sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b6718ce1cf36de828a101a27dce53ea

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

kernel32

user32

msvcp140

ntdll

winmm

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 247KB - Virtual size: 246KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 512B - Virtual size: 192B

.text
Size: 247KB - Virtual size: 246KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 512B - Virtual size: 192B