scarica[.]exe | Triage™

General

Target
scarica.exe
Size 326KB
Sample230123-n8k2bseg21
SHA256 8b154b06cc094eb22a4aae98f2bc60e4759f6258aa5bfb364f44b665bf65ff1e
MD5 e69eafc32f8c769b05b47627c4ff2c5a
SHA1 07cdfd9245a4fe69f64ca6fb3312a78f350d4304
SHA512 e8648d5598997544acd0282b5936a2211cef766ccd964b1a4d12da26a531d0c65dcb43a9ffdc961d27376afb991a40499157507757e785edfb4d219fa924d7c2
SSDEEP 6144:DpLnOXF70swsXDsOtQtQK/fu1d0F7YxmTbl:DpTOhdwywhtQKXu12c
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

scarica.exe

.exe 326KB

scarica.exe

IMPHASH 2eeee268b6406cc3de64a027329920a2
SHA256 8b154b06cc094eb22a4aae98f2bc60e4759f6258aa5bfb364f44b665bf65ff1e
MD5 e69eafc32f8c769b05b47627c4ff2c5a
SHA1 07cdfd9245a4fe69f64ca6fb3312a78f350d4304
SHA512 e8648d5598997544acd0282b5936a2211cef766ccd964b1a4d12da26a531d0c65dcb43a9ffdc961d27376afb991a40499157507757e785edfb4d219fa924d7c2
SSDEEP 6144:DpLnOXF70swsXDsOtQtQK/fu1d0F7YxmTbl:DpTOhdwywhtQKXu12c
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18047

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerSetConditionMask SetConsoleActiveScreenBuffer GetModuleHandleW ReadConsoleW GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW GetPriorityClass GlobalAlloc LoadLibraryW GetNamedPipeInfo GetConsoleAliasW GetDevicePowerState IsBadStringPtrA LCMapStringA SetLastError lstrcmpiA GetProcAddress VirtualAlloc InterlockedIncrement BuildCommDCBW LoadLibraryA OpenWaitableTimerW DnsHostnameToComputerNameA AddAtomW CreateEventW SetCommMask FreeEnvironmentStringsW VirtualProtect GetConsoleCursorInfo EndUpdateResourceA CreateWaitableTimerA GetConsoleProcessList EnumCalendarInfoExA LCMapStringW GetStringTypeW MultiByteToWideChar lstrlenA FindResourceExW HeapSize CreateFiber GetLastError HeapFree HeapAlloc Sleep ExitProcess GetStartupInfoW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetStringTypeA

user32

GetCaretPos WindowFromDC GetMenuInfo GetCursorInfo

gdi32

GetCharWidthA

advapi32

BackupEventLogW

Name

.text

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.woweney

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dazib

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dotibek

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

scarica.exe

kernel32

user32

gdi32

advapi32