Payload[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Payload.exe
Size

883KB
MD5

a4e4a27a19c27488097b87600084b05e
SHA1

ac7f53a2cdad3987ca59fb5da91914cdbf3fed8f
SHA256

e2c50d72acb77457c1cc0f3263687de957c71cfa18ccbb0c93fc737e1496cce4
SHA512

a4adc11f88f2d5353794738725cb4a613ec27e18c9f9a2eed5bcd3965ee1e0d4489da2f2718b8f5be5f7daa05c5ad37ac3f218245b0d370897cba0227130bc8c
SSDEEP

12288:2WqNI+UYrtpV8QeiUXoxhmYa195ni9ZFLjGHIAP2Yhx7SzYff88EONKRF8VYWw6F:3Dtgp+PXebiMLMFBSzYNoRCZpuEf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Payload.exe

Files

Payload.exe
.exe windows x86

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_cexit
_amsg_exit
__set_app_type
_XcptFilter
__wgetmainargs
_configthreadlocale
__p__commode
__p__fmode
__FrameUnwindFilter
_time64
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
memmove
strncmp
strchr
atol
atoi
_strtoui64
??_U@YAPAXI@Z
strncpy
strrchr
strtoul
isdigit
isalpha
_strupr
_gmtime32_s
srand
rand
_wcsupr
wcsncmp
wcstombs
strstr
_aligned_malloc
free
memset
_CxxThrowException
_strnicmp
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
malloc
__CxxFrameHandler3
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy
_except_handler3
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_encode_pointer

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
GetModuleHandleA
UnmapViewOfFile
CloseHandle
InterlockedExchange
VirtualProtect
VirtualQuery
GetCurrentThreadId
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
GetCurrentProcessId
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindResourceA
LoadResource
UnhandledExceptionFilter
CreateToolhelp32Snapshot
Module32First
GetProcAddress
Module32Next
EnumResourceNamesA
GetModuleFileNameA
CreateFileA
ReadFile
VirtualAlloc
SetFilePointer
VirtualFree
GetModuleHandleExA
CreateEventA
ExitProcess
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
HeapAlloc
HeapFree
GetComputerNameW
WideCharToMultiByte
LocalFree
HeapCreate
HeapDestroy
GetSystemTime
SystemTimeToFileTime
GetCommandLineW
GlobalAlloc
GetSystemInfo
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
GetCurrentThread
CreateFileW
GlobalFree
LoadLibraryA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
MapViewOfFile
CreateFileMappingA
lstrcmpA
LocalAlloc
GetModuleFileNameW
GetLastError
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
OutputDebugStringA
GetCurrentProcess
TerminateProcess
LockResource
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
lstrlenW
MultiByteToWideChar
lstrlenA

advapi32

CryptAcquireContextA
CryptDestroyKey
CryptExportKey
CryptGenKey
CloseEventLog
ReadEventLogA
GetNumberOfEventLogRecords
OpenEventLogA
CryptGenRandom
LookupAccountSidW
ConvertSidToStringSidA
GetTokenInformation
SetThreadToken
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegCloseKey
OpenThreadToken
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
OpenProcessToken

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SystemTimeToVariantTime
SysAllocString

msvcm80

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
__setusermatherr_m
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

mscoree

GetHashFromFileW
_CorExeMain

ws2_32

setsockopt
WSACleanup
freeaddrinfo
getaddrinfo
closesocket
WSAStartup
socket
send
recv
shutdown
connect

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WinVerifyTrust

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
CryptQueryObject

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc

shell32

CommandLineToArgvW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

rpcrt4

UuidCreate

Sections

.text
Size: 674KB - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

Imports

msvcr80

kernel32

advapi32

oleaut32

msvcm80

mscoree

ws2_32

wintrust

crypt32

iphlpapi

ole32

shell32

setupapi

rpcrt4

Sections

.text Size: 674KB - Virtual size: 673KB

.rdata Size: 122KB - Virtual size: 122KB

.data Size: 6KB - Virtual size: 10KB

.rsrc Size: 59KB - Virtual size: 59KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 674KB - Virtual size: 673KB

.rdata
Size: 122KB - Virtual size: 122KB

.data
Size: 6KB - Virtual size: 10KB

.rsrc
Size: 59KB - Virtual size: 59KB

.reloc
Size: 13KB - Virtual size: 12KB