sys32[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sys32.exe
Size 2.2MB
Sample230503-l71dhsgb2w
SHA256 90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c
MD5 748de52961d2f182d47e88d736f6c835
SHA1 30cc7724be4a09d5bcd9254197af05e9fab76455
SHA512 6c549f98d09d7c06dcbbc650ac4da7a9c66e1ce29709e4a5024d0cf8139cf3a7bfe246f049ce779c3f5bf8473df4ceac5b291510e4e8d35ae047044894d743c8
SSDEEP 49152:CtNUaQsh3Ss/flyXP8BnzoVPgfpQO21F8k:CtNUA3vlyXPE0qR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sys32.exe

File Explorer

sys32.exe

.exe 2.2MB

sys32.exe

IMPHASH 11fc1edb442e257617e8672be635a02f
SHA256 90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c
MD5 748de52961d2f182d47e88d736f6c835
SHA1 30cc7724be4a09d5bcd9254197af05e9fab76455
SHA512 6c549f98d09d7c06dcbbc650ac4da7a9c66e1ce29709e4a5024d0cf8139cf3a7bfe246f049ce779c3f5bf8473df4ceac5b291510e4e8d35ae047044894d743c8
SSDEEP 49152:CtNUaQsh3Ss/flyXP8BnzoVPgfpQO21F8k:CtNUA3vlyXPE0qR
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1542760

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError HeapReAlloc CloseHandle RaiseException CreateThread HeapAlloc DecodePointer GetProcAddress SetFilePointerEx DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte lstrcmpiW CreateIoCompletionPort MoveFileW GetDriveTypeW FlushFileBuffers SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA Sleep VirtualFree MultiByteToWideChar GetStdHandle GetFileType GetEnvironmentVariableW GetACP QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetLogicalDriveStringsW HeapSize OpenProcess CreateFileW InitializeCriticalSectionEx CreateMutexW SetEndOfFile GetQueuedCompletionStatus InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects WakeAllConditionVariable TerminateProcess WriteFile GetCurrentProcess GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FindNextFileW GetCommandLineW EnterCriticalSection HeapFree GetFileSizeEx FindFirstFileW CancelIo ReadFile GetLocaleInfoW LCMapStringW CompareStringW SleepConditionVariableCS GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetConsoleOutputCP GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle SetConsoleCtrlHandler GetModuleHandleExW ExitProcess LoadLibraryExW RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW InitializeCriticalSectionAndSpinCount OutputDebugStringW IsDebuggerPresent GetNativeSystemInfo GetStringTypeW EncodePointer LCMapStringEx GetCPInfo WriteConsoleW

user32

GetProcessWindowStation wsprintfW MessageBoxW GetUserObjectInformationW

advapi32

CryptDestroyHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptEnumProvidersW CryptSignHashW DeregisterEventSource CryptCreateHash CryptDecrypt

shell32

CommandLineToArgvW ShellExecuteW

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

netapi32

NetShareEnum NetApiBufferFree

iphlpapi

GetIpAddrTable

ws2_32

select ntohs getsockopt ioctlsocket bind WSACleanup closesocket ntohl WSASocketW WSAStartup socket WSAAddressToStringW htonl htons WSAGetLastError inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError recv send connect gethostbyname setsockopt shutdown WSAIoctl

bcrypt

BCryptGenRandom