Tuke_Negro[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Tuke_Negro.exe
Size

314KB
MD5

2ba62bf3bcfd7f841a6bddeab071c566
SHA1

12ae720aaaaa55cfe764549e32e488025ee6fab6
SHA256

2c0ee7d5b6036e6cda62203de9d1a46f881d033021d17f80c0cd053e1c736f05
SHA512

f4815e568fd9f99851802b45d3b06c6973b11171c8172f64893d1f6cf5b023928db66d70d3390e0eb3971700255b61cfc506a9c126768a5d880467ef536d3942
SSDEEP

6144:Dsex2RoW3658VZRXsdVxp/0SRCotu9nqSOj:DseVW348vRgp89nqF

Score

1^/10

Malware Config

Signatures

Files

Tuke_Negro.exe
.exe windows x64

50b30da1b43153598da37c3f8b076066

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d9

Direct3DCreate9

kernel32

MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
CreateThread
Sleep
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CloseHandle
IsProcessorFeaturePresent
OpenProcess
Module32First
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
Module32Next
GetConsoleWindow
InitializeSListHead

user32

GetCapture
ScreenToClient
UpdateWindow
DispatchMessageA
DestroyWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
ClientToScreen
ShowWindow
IsChild
TrackMouseEvent
SetCapture
SetCursor
GetClientRect
ReleaseCapture
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
SendMessageA
SendInput
GetAsyncKeyState
FindWindowA
GetForegroundWindow
GetClassLongPtrW
GetWindowThreadProcessId
GetCursorPos
SetCursorPos
LoadCursorA

msvcp140

?_Random_device@std@@YAIXZ
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

ntdll

ZwReadVirtualMemory
ZwQueryVirtualMemory
ZwWriteVirtualMemory

winmm

PlaySoundA

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
memchr
strstr
memset
memcmp
memcpy
memmove

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
__p___argc
_exit
_cexit
__p___argv
exit
_initterm_e
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_crt_atexit

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vsprintf
fclose
fseek
fread
fflush
__p__commode
ftell
_wfopen
_set_fmode
fwrite

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

fmodf
cosf
ceilf
__setusermatherr
roundf
acosf
sinf
sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50b30da1b43153598da37c3f8b076066

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

kernel32

user32

msvcp140

ntdll

winmm

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 245KB - Virtual size: 245KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 512B - Virtual size: 184B

.text
Size: 245KB - Virtual size: 245KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 512B - Virtual size: 184B