04228599[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
04228599.exe
Size 191KB
Sample230613-n1wsvsga49
SHA256 25f771e57e57c0b078285aeda8b48e0a8ac77e02e4202193b2eae25d415f9e11
MD5 067594d9f40a1ff4f492dd14b4b5a2a7
SHA1 797c6d73c986a3ebe8e8c5f304213ac4c935d853
SHA512 b78b6efb8efb51f8c27abf933c6210f2533df6e74c94bbe19ec3ca27180a48420702532e2bc739f35a1bf3950e79126ed7ddaf23f75de01d45db93dbedef71cd
SSDEEP 3072:uD9bRd2l5nafJNZrogIE/OZBPymfc2gJn+dyv1GNysh30kUrIH:uD9r85oJN5rIbZBamfwJoh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04228599.exe

File Explorer

04228599.exe

.exe 191KB

04228599.exe

IMPHASH a10a082d1b272e3c30540cbcb76f03c1
SHA256 25f771e57e57c0b078285aeda8b48e0a8ac77e02e4202193b2eae25d415f9e11
MD5 067594d9f40a1ff4f492dd14b4b5a2a7
SHA1 797c6d73c986a3ebe8e8c5f304213ac4c935d853
SHA512 b78b6efb8efb51f8c27abf933c6210f2533df6e74c94bbe19ec3ca27180a48420702532e2bc739f35a1bf3950e79126ed7ddaf23f75de01d45db93dbedef71cd
SSDEEP 3072:uD9bRd2l5nafJNZrogIE/OZBPymfc2gJn+dyv1GNysh30kUrIH:uD9r85oJN5rIbZBamfwJoh
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24820

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_NO_BIND IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_UP_SYSTEM_ONLY

PDB paths

kernel32

QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetModuleFileNameW WriteFile LoadLibraryW CreateFileW HeapFree Sleep DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount IsProcessorFeaturePresent GetCurrentProcess TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetTickCount GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetStartupInfoW HeapSetInformation GetCommandLineA DecodePointer ExitProcess GetModuleHandleW GetSystemTimeAsFileTime GetConsoleMode SetConsoleMode GetCurrentProcessId RaiseException LCMapStringW GetStringTypeW RtlUnwind HeapReAlloc GetConsoleCP FlushFileBuffers WriteConsoleW HeapSize SetFilePointer lstrcpyA LocalFree CloseHandle GetVersionExA OutputDebugStringA CompareStringA GetModuleHandleA FindNextFileA DeviceIoControl LoadLibraryA ResetEvent FindClose GlobalFree GetProcAddress GetLastError FindFirstFileA GetStdHandle SetCurrentDirectoryA GlobalUnlock GetOverlappedResult lstrcatA CreateFileA ReadFile HeapCreate CreateEventA ReadConsoleInputA GlobalAlloc FlushConsoleInputBuffer WaitForSingleObject GlobalLock HeapAlloc GetNumberOfConsoleInputEvents GetLocaleInfoA lstrlenA lstrcmpA LeaveCriticalSection EnterCriticalSection MultiByteToWideChar GetFileSize SetStdHandle

user32

OpenClipboard GetDialogBaseUnits ModifyMenuA GetWindow MoveWindow DispatchMessageA IsWindow AppendMenuA CreatePopupMenu ShowWindow SystemParametersInfoA GetCursorPos SetWindowPos DefWindowProcA EndDialog GetDlgItem EmptyClipboard EnableMenuItem ReleaseDC PeekMessageA CreateWindowExA GetSystemMetrics SetWindowTextA EnableWindow SetClipboardData CallWindowProcA SetMenuItemInfoA GetDlgItemTextA GetDlgCtrlID SetLayeredWindowAttributes LoadCursorA EndPaint DestroyWindow SetCursor CloseClipboard SetWindowRgn GetSystemMenu SetTimer GetWindowRect InsertMenuItemA PostQuitMessage TrackPopupMenu FillRect GetKeyState GetSubMenu DrawIconEx LoadStringA CopyImage IsClipboardFormatAvailable GetParent LoadMenuA wsprintfA GetClientRect SetFocus SendMessageA BeginPaint GetDC TranslateMessage GetMenu GetWindowTextA TrackPopupMenuEx SetWindowLongA MessageBoxA InvalidateRect GetWindowLongA

gdi32

GetBitmapBits MoveToEx EndPage BitBlt PatBlt SetViewportOrgEx SetWindowExtEx StartPage SetTextColor DeleteDC CreateFontA GetDeviceCaps StretchBlt CreateFontIndirectA SetBkColor CreateDCA SetPixel SetAbortProc CreateBitmap SetBkMode DeleteObject SelectObject CreateCompatibleDC CombineRgn SetMapMode CreateCompatibleBitmap Rectangle StartDocA Ellipse FillRgn SaveDC CreateRectRgn CreatePen SetTextAlign GetPixel GetObjectA EndDoc GetStockObject RestoreDC CreateSolidBrush EnumFontsA TextOutA LineTo

advapi32

AllocateAndInitializeSid RegCloseKey AreAnyAccessesGranted

shell32

SHChangeNotify SHGetSpecialFolderLocation

ole32

CoCreateInstance CoUninitialize CoTaskMemFree StgOpenStorage CoInitialize WriteClassStg StgCreateDocfile ReadClassStg CreateStreamOnHGlobal

oleaut32

OleSavePictureFile OleLoadPicture

odbc32

ord24

psapi

GetWsChanges

winmm

waveOutPrepareHeader waveOutClose waveOutUnprepareHeader waveOutOpen waveOutWrite

comctl32

ord17

rpcrt4

RpcServerUseProtseqEpA RpcServerListen RpcServerRegisterIf2

gdiplus

GdipSaveImageToFile GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDrawEllipseI GdipDeleteGraphics GdipDeletePen GdipFree GdiplusShutdown GdipDrawLineI GdipCreatePen1 GdipDrawRectangleI GdiplusStartup GdipAlloc

setupapi

SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiOpenDeviceInterfaceRegKey SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ