Payload[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Payload.exe
Size

603KB
MD5

97cec458bcfd75a9e22834c0c2a5bbfc
SHA1

c150929df12526a9b42a4141ecee333b76c02303
SHA256

6e416fe22e14e0b939e9faa79cc3f87562eec55f39101c767a4f5a2b4c5e4c69
SHA512

9c013f32db4c437f9e72d746639baaee3ba0a4f9aa0cfb51545bd47299f8aca88e177cc3ae34f5bbd360bd2019a82705058bf1e76c1bd20f8cdfb4430b02a75b
SSDEEP

12288:nnRPEutAAUinQoVgiqPhLSnh/Lb1PTzGBPibLRnf8su9rz:RUAUiQ/tSnhD1SP4LRf8p9rz

Score

1^/10

Malware Config

Signatures

Files

Payload.exe
.exe windows x86

4f04446d9478dd35432af8e95d3d606e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

__CxxDetectRethrow
__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_cexit
_amsg_exit
_XcptFilter
__wgetmainargs
?_query_new_mode@@YAHXZ
__set_app_type
_configthreadlocale
__p__commode
__p__fmode
_encoded_null
__FrameUnwindFilter
_time64
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
memmove
strncmp
strchr
atol
atoi
_strtoui64
??_U@YAPAXI@Z
strncpy
strrchr
strtoul
isdigit
isalpha
_strupr
_gmtime32_s
srand
rand
_wcsupr
wcsncmp
wcstombs
strstr
_aligned_malloc
__CxxFrameHandler3
malloc
free
_strnicmp
__CxxRegisterExceptionObject
__CxxExceptionFilter
_CxxThrowException
memset
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy
_except_handler3
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_encode_pointer
__setusermatherr

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetModuleHandleA
UnmapViewOfFile
CloseHandle
InterlockedExchange
VirtualProtect
VirtualQuery
GetCurrentThreadId
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
GetCurrentProcessId
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindResourceA
GetCurrentProcess
LockResource
CreateToolhelp32Snapshot
Module32First
GetProcAddress
Module32Next
EnumResourceNamesA
GetModuleFileNameA
CreateFileA
ReadFile
VirtualAlloc
SetFilePointer
VirtualFree
GetModuleHandleExA
CreateEventA
ExitProcess
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
HeapAlloc
HeapFree
GetComputerNameW
WideCharToMultiByte
LocalFree
HeapCreate
HeapDestroy
GetSystemTime
SystemTimeToFileTime
GetCommandLineW
GlobalAlloc
GetSystemInfo
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
GetCurrentThread
CreateFileW
GlobalFree
LoadLibraryA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
MapViewOfFile
CreateFileMappingA
lstrcmpA
LocalAlloc
GetModuleFileNameW
GetLastError
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
OutputDebugStringA
TerminateProcess
LoadResource
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenA
lstrlenW

advapi32

RegCloseKey
CryptExportKey
CryptGenKey
CloseEventLog
ReadEventLogA
GetNumberOfEventLogRecords
OpenEventLogA
CryptGenRandom
LookupAccountSidW
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
SetThreadToken
RevertToSelf
OpenThreadToken
RegOpenKeyExA
RegEnumValueA
CryptDestroyKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SystemTimeToVariantTime
SysAllocString

msvcm90

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
__setusermatherr_m
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

mscoree

GetHashFromFileW
_CorExeMain

ws2_32

setsockopt
WSACleanup
freeaddrinfo
getaddrinfo
closesocket
WSAStartup
socket
send
recv
shutdown
connect

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WinVerifyTrust

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
CryptQueryObject

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc

shell32

CommandLineToArgvW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

rpcrt4

UuidCreate

Sections

.text
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f04446d9478dd35432af8e95d3d606e

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

advapi32

oleaut32

msvcm90

mscoree

ws2_32

wintrust

crypt32

iphlpapi

ole32

shell32

setupapi

rpcrt4

Sections

.text Size: 451KB - Virtual size: 450KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 6KB - Virtual size: 10KB

.rsrc Size: 1024B - Virtual size: 838B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 451KB - Virtual size: 450KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 6KB - Virtual size: 10KB

.rsrc
Size: 1024B - Virtual size: 838B

.reloc
Size: 13KB - Virtual size: 12KB