597[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

597.exe
Size

168KB
MD5

333307be6be7318cb48745cc820d3896
SHA1

29d8cb35e45f5abebf3efc4b9ac40bf6fa3149ff
SHA256

db6b418471d5ae8b92df0d0ca50fe0f2a4b4e7e8b57700c28309bbbe1826aadb
SHA512

c23261cae613816327d2eba77be015847314407685ed8237b185b98ec4f3b8c3c08175f5d7b3d742882a8a8dd2b3073600b57417657c6025020cabb04d75bfaf
SSDEEP

3072:+kiRly3qgNnroGXfEMAJ8nu3Jm3Xdi8fmhm61tap3i1o2s:Gl5gtfE1JrU3XkW4mJi1xs

Score

1^/10

Malware Config

Signatures

Files

597.exe
.zip

Password: DsUjmlG885/kkmS
Device/HarddiskVolume4/Data/CTXProfiles/mtribenga/UPM_Profile/597.exe
.exe windows x86

Password: DsUjmlG885/kkmS

fa7bb056d9cb8cc9e0a78aabfbfff713

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetVersionExA
GetModuleHandleA
GetModuleFileNameA
VirtualProtectEx
GetEnvironmentVariableA
Sleep
OpenProcess
GetDateFormatA
GetWindowsDirectoryA
QueryPerformanceCounter
LoadResource
FindResourceA
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
GetCommandLineA
HeapFree
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
HeapSize
MultiByteToWideChar
GetLocaleInfoA

user32

UnhookWinEvent

ole32

OleInitialize
CoUninitialize
CoInitialize
OleCreate
CoRegisterClassObject

advapi32

OpenServiceA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
FreeSid
OpenSCManagerA
SetSecurityDescriptorOwner
SetServiceStatus
AllocateAndInitializeSid
QueryServiceStatus
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegisterServiceCtrlHandlerA
RegSetValueExA
SetSecurityDescriptorGroup
OpenThreadToken
StartServiceCtrlDispatcherA
OpenProcessToken

oleacc

GetOleaccVersionInfo
AccessibleObjectFromWindow
AccessibleObjectFromPoint

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: DsUjmlG885/kkmS

Password: DsUjmlG885/kkmS

fa7bb056d9cb8cc9e0a78aabfbfff713

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

advapi32

oleacc

Sections

.text Size: 96KB - Virtual size: 92KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 64KB - Virtual size: 113KB

.rsrc Size: 324KB - Virtual size: 320KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 96KB - Virtual size: 92KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 64KB - Virtual size: 113KB

.rsrc
Size: 324KB - Virtual size: 320KB

.reloc
Size: 8KB - Virtual size: 7KB