xlabs[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

xlabs.exe
Size

1.7MB
MD5

57c1057a55fbfb033050a362392021ff
SHA1

37dd6b2652de1f00b24ccc8677e6b114f147d0ec
SHA256

b09e39c2fb59c0fb084895abf11a35a87ced378ae1001fdd6c626110357d9b93
SHA512

6b02d83d5d40382fa6839fb0d396188e151fad1cb38ab6a3eab6e148e238fd84fb17c6474402b0aba2b77a19cce39ad9fb79af58af16231368cbe7d0aa59274d
SSDEEP

24576:vedP2ynGlLyPoRlgFwRx5sDjyN/FLakDGCo7w/Dh0lhSMXlEw4fo7oUzL4q:vqP2rka58jyNtLDDaj+PELn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

xlabs.exe

resource
xlabs.exe

Files

xlabs.exe
.exe windows x64

2c208ce75c71f15282abc299cf1c0f92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoW
GetTickCount
GetEnvironmentVariableA
SleepEx
FormatMessageW
MoveFileExA
WaitForMultipleObjects
Process32First
VirtualProtect
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
LoadLibraryA
Process32Next
CloseHandle
GetCurrentDirectoryW
GetCurrentProcessId
CreateProcessW
FreeLibrary
SetDllDirectoryW
GetDllDirectoryW
DeleteFileW
MoveFileW
CreateMutexA
ReleaseMutex
GetCommandLineW
LocalFree
VirtualQuery
SetLastError
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoEx
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
PeekNamedPipe
TryAcquireSRWLockExclusive
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
GetModuleHandleExW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
EnterCriticalSection
LeaveCriticalSection
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
GetSystemInfo
LoadLibraryExA
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
CreateFileA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEnvironmentVariableA
GetCommandLineA
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
AcquireSRWLockExclusive
GetProcAddress

user32

GetWindowLongPtrA
GetPropA
GetSystemMetrics
EnumChildWindows
SetPropA
LoadIconA
PostMessageA
SetParent
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
SetProcessDPIAware
ShowWindow
SetForegroundWindow
MessageBoxA
SetWindowPos
GetWindowRect
ReleaseCapture
SetWindowRgn

gdi32

CreateRoundRectRgn
PtInRegion
CreateRectRgn
DeleteObject
SetRectRgn
CombineRgn

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptGetProperty

shell32

CommandLineToArgvW
SHGetKnownFolderPath
SHCreateItemFromParsingName

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
VariantInit

crypt32

CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
PFXImportCertStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine

ws2_32

ntohs
WSASetLastError
WSAGetLastError
closesocket
setsockopt
WSAIoctl
htons
select
__WSAFDIsSet
recv
connect
socket
getsockname
getpeername
bind
sendto
recvfrom
listen
accept
htonl
freeaddrinfo
getaddrinfo
ioctlsocket
gethostname
WSAEventSelect
WSAResetEvent
send
WSACreateEvent
WSAWaitForMultipleEvents
getsockopt
WSAEnumNetworkEvents
WSACleanup
WSAStartup
WSACloseEvent

advapi32

CryptEncrypt
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptImportKey
CryptDestroyKey
CryptReleaseContext

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 427KB - Virtual size: 426KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c208ce75c71f15282abc299cf1c0f92

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

bcrypt

shell32

ole32

oleaut32

crypt32

ws2_32

advapi32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 427KB - Virtual size: 426KB

.data Size: 38KB - Virtual size: 45KB

.pdata Size: 48KB - Virtual size: 47KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 202KB - Virtual size: 202KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 427KB - Virtual size: 426KB

.data
Size: 38KB - Virtual size: 45KB

.pdata
Size: 48KB - Virtual size: 47KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 202KB - Virtual size: 202KB