file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

419KB
MD5

18c731f78ffad5975be6fa22e25399f2
SHA1

42175615718cfc0694ec54a3c6a5a1215750d2fb
SHA256

5f2e2a92401ea7488c47caffc88acce66e4e66c6c631ff44a35859ff8a4b66ac
SHA512

2fddf1ff4d4b4ba6244f1b000bb68c05cd7357fda5015561345571e186fe878f430afc29460094c4afcb504cbfdd5a878d1d61ba26bec462986af534fc7eeafd
SSDEEP

6144:tl073J3SYx1K4tCO9rInWpg4t0+eoJAbB3T+cbJp:63JiYHKHqkAd0+5cCIJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

Files

file.exe
.exe windows x64

416ffe7b0605a5e274a0fae7bef800aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

kernel32

GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
CreateMutexW
lstrlenA
MultiByteToWideChar
ReleaseMutex
GetVersionExW
GetSystemDefaultUILanguage
Sleep
CloseHandle
WriteFile
lstrlenW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RegisterApplicationRestart
HeapSetInformation
DeleteFileW
GetTempPathW
FreeLibrary
WideCharToMultiByte
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
RaiseException
GlobalDeleteAtom
GlobalAddAtomW
GetLastError
GetCurrentThreadId
SetLastError

gdi32

CreateCompatibleBitmap
CreatePen
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
GetStockObject
Rectangle
SelectObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetLayout
GetClipRgn
SelectClipRgn
GetObjectW
CreatePolygonRgn
OffsetRgn
FillRgn
PatBlt
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
SetLayout
CreateSolidBrush

user32

MapWindowPoints
GetMonitorInfoW
CopyRect
UnregisterClassA
DeferWindowPos
BeginDeferWindowPos
SetCursor
GetIconInfo
GetWindowTextW
CallWindowProcW
DrawIconEx
OffsetRect
GetWindowRgnBox
UnregisterHotKey
GetWindowLongW
GetForegroundWindow
DestroyMenu
CheckMenuRadioItem
GetSystemMetrics
IsWindowVisible
ShowWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetWindowLongPtrW
SetWindowLongPtrW
BeginPaint
LoadMenuW
SetCapture
ReleaseCapture
UnionRect
InvalidateRect
GetPropW
SetPropW
IntersectRect
EnumDisplayMonitors
IsIconic
PtInRect
GetWindow
LogicalToPhysicalPoint
SetRect
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
LoadAcceleratorsW
GetWindowRect
TranslateAcceleratorW
LoadStringW
CreateWindowExW
AdjustWindowRect
RegisterHotKey
DestroyWindow
MonitorFromWindow
EndDeferWindowPos
LoadIconW
GetSubMenu
LoadImageW
SetClassLongPtrW
SetWindowTextW
IsZoomed
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
GetClientRect
DrawFocusRect
DrawTextW
GetProcessDefaultLayout
TrackPopupMenuEx
SetScrollInfo
GetScrollInfo
SetFocus
DefWindowProcW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
AdjustWindowRectEx
InflateRect
FillRect
SendMessageW
EndDialog
GetDlgItem
GetDC
SetForegroundWindow
OpenIcon
FindWindowW
MessageBoxW
GetSysColor
SetWindowPos
GetWindowDC
GetDesktopWindow
PostQuitMessage
SystemParametersInfoW

msvcrt

__CxxFrameHandler3
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
free
_vsnwprintf
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
_wcsicmp
memcpy_s
wcscspn
wcsspn
memmove_s
malloc
_resetstkoflw
strstr
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
memset
__C_specific_handler
vswprintf_s
_CxxThrowException

ntdll

WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
WinSqmIsOptedIn

gdiplus

GdipSaveImageToStream
GdipMeasureString
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipCreateFontFromLogfontW
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawString
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipGetImageEncoders

shlwapi

UrlCreateFromPathW
PathFindExtensionW
StrStrA
PathIsURLW
StrChrW
ord487
PathFindFileNameW
ord158
SHRegGetUSValueW
PathRemoveExtensionW

shell32

ShellAboutW
ord75
SHCreateItemInKnownFolder

ole32

CoTaskMemFree
StringFromCLSID
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

uxtheme

GetThemeSysFont
GetThemeSysColor

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 244KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

416ffe7b0605a5e274a0fae7bef800aa

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

shlwapi

shell32

ole32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 165KB - Virtual size: 165KB

.data Size: 1024B - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 244KB - Virtual size: 248KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.data
Size: 1024B - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 244KB - Virtual size: 248KB

.reloc
Size: 1KB - Virtual size: 1KB