597[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
597.exe
Size 168KB
Sample230322-j8cbzaff93
SHA256 db6b418471d5ae8b92df0d0ca50fe0f2a4b4e7e8b57700c28309bbbe1826aadb
MD5 333307be6be7318cb48745cc820d3896
SHA1 29d8cb35e45f5abebf3efc4b9ac40bf6fa3149ff
SHA512 c23261cae613816327d2eba77be015847314407685ed8237b185b98ec4f3b8c3c08175f5d7b3d742882a8a8dd2b3073600b57417657c6025020cabb04d75bfaf
SSDEEP 3072:+kiRly3qgNnroGXfEMAJ8nu3Jm3Xdi8fmhm61tap3i1o2s:Gl5gtfE1JrU3XkW4mJi1xs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

597.exe

.zip 168KB
Device/HarddiskVolume4/Data/CTXProfiles/mtribenga/UPM_Profile/597.exe

.exe 520KB
manifest.json

258B

597.exe

SHA256 db6b418471d5ae8b92df0d0ca50fe0f2a4b4e7e8b57700c28309bbbe1826aadb
MD5 333307be6be7318cb48745cc820d3896
SHA1 29d8cb35e45f5abebf3efc4b9ac40bf6fa3149ff
SHA512 c23261cae613816327d2eba77be015847314407685ed8237b185b98ec4f3b8c3c08175f5d7b3d742882a8a8dd2b3073600b57417657c6025020cabb04d75bfaf
SSDEEP 3072:+kiRly3qgNnroGXfEMAJ8nu3Jm3Xdi8fmhm61tap3i1o2s:Gl5gtfE1JrU3XkW4mJi1xs
MD5 SHA1 SHA512 SSDEEP

Password

DsUjmlG885/kkmS

Device/HarddiskVolume4/Data/CTXProfiles/mtribenga/UPM_Profile/597.exe

IMPHASH fa7bb056d9cb8cc9e0a78aabfbfff713
SHA256 f3f6b15265480c52e302f9f0b31ad6cc9051c16d16f1204bf78866e53c395896
MD5 b32e9684b7b980d5e701f5d691e3db31
SHA1 90eba241c5ec0ac472b180840f423a887401337c
SHA512 8479ba8ada4c3d8b151fcd8395782ab5782df33dc76fc2e5bdd711842ad81242fed15f47110ae586124ac2530a1e926861f9f57487c7daf58e856874e0d33fc2
SSDEEP 6144:DAVTFjFS3Q6fYnZy0EVHYNeSgTwl0lJgJ9vcl9CK:DEIQTZvs4NGT7goGK
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

DsUjmlG885/kkmS

Minor OS version

Major OS version

Entry point

11554

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemTime GetVersionExA GetModuleHandleA GetModuleFileNameA VirtualProtectEx GetEnvironmentVariableA Sleep OpenProcess GetDateFormatA GetWindowsDirectoryA QueryPerformanceCounter LoadResource FindResourceA CreateFileA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA HeapAlloc GetCommandLineA HeapFree GetProcessHeap GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection LoadLibraryA GetCPInfo GetACP GetOEMCP HeapSize MultiByteToWideChar GetLocaleInfoA

user32

UnhookWinEvent

ole32

OleInitialize CoUninitialize CoInitialize OleCreate CoRegisterClassObject

advapi32

OpenServiceA RegCloseKey RegEnumKeyA RegOpenKeyA FreeSid OpenSCManagerA SetSecurityDescriptorOwner SetServiceStatus AllocateAndInitializeSid QueryServiceStatus RegOpenKeyExA RegCreateKeyExA LookupPrivilegeValueA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegisterServiceCtrlHandlerA RegSetValueExA SetSecurityDescriptorGroup OpenThreadToken StartServiceCtrlDispatcherA OpenProcessToken

oleacc

GetOleaccVersionInfo AccessibleObjectFromWindow AccessibleObjectFromPoint