client[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

client.exe
Size

1.3MB
MD5

1c4fcdfe9161f8688a3a3737e46ea7ce
SHA1

b9a79d5f8eb8e62162d5798eb1155691e8af161b
SHA256

9a4b65f0d34ea6c0c5d4e216fdaf76ed1a93c28e4bd17609b640fb4747927458
SHA512

2f10089a41102b494a4215f90bfee94f01211b8ad465050c73b703f2d22ec531a18f543470169d952ce5b355f7afd84581a77b73eb4d63585af1d66806869a08
SSDEEP

24576:YhzX12X6R767MpIJq5o68jTGJFJepfaxhrMOr/0rid/6v:XTaQpLOQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

Files

client.exe
.exe windows x86

15045bbe7aa9305a694228debbd1aff7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetLastError
CreateMutexA
CreateProcessA
UnmapViewOfFile
MapViewOfFile
WideCharToMultiByte
FlushViewOfFile
GetCurrentProcessId
GetVersion
OpenFileMappingA
GetACP
IsDBCSLeadByte
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
ReadFile
WriteFile
TerminateProcess
OpenMutexA
CloseHandle
GetProfileStringA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
CreateFileMappingA
GetTimeZoneInformation
HeapReAlloc
TlsGetValue
SetLastError
TlsAlloc
GetCurrentThreadId
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsSetValue
ResumeThread
GetLocalTime
GetSystemTime
DeleteFileA
CreateDirectoryA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
HeapAlloc
HeapFree
RtlUnwind
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
InterlockedIncrement
InterlockedExchange
Sleep
CreateThread
GetStringTypeA
GetTickCount
VirtualAlloc
IsBadWritePtr
GetFullPathNameA
GetCurrentDirectoryA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
SetEnvironmentVariableA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetOEMCP
GetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
OutputDebugStringA
GlobalMemoryStatus
GetDiskFreeSpaceA
InterlockedDecrement
GetDriveTypeA
SetEndOfFile
CompareStringA
CompareStringW
GetLogicalDriveStringsA
GetSystemInfo

user32

GetKeyState
IsZoomed
ShowWindow
GetDesktopWindow
GetDC
SetFocus
SetCapture
AppendMenuA
GetCursorPos
ShowCursor
TrackPopupMenu
DestroyMenu
PeekMessageA
DefWindowProcA
GetKeyNameTextA
GetDoubleClickTime
GetAsyncKeyState
ScreenToClient
MessageBoxA
FindWindowA
RegisterClassA
UpdateWindow
GetMessageA
GetFocus
MapVirtualKeyA
ReleaseCapture
GetActiveWindow
DefWindowProcW
SetMenu
AdjustWindowRectEx
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClassW
CreateWindowExW
GetWindowDC
SystemParametersInfoA
BeginPaint
EndPaint
GetWindowRect
SetWindowPos
SetCursor
ClientToScreen
PostQuitMessage
GetWindowLongA
SetWindowLongA
LoadIconA
GetSystemMetrics
TranslateMessage
TranslateAcceleratorA
DispatchMessageA
LoadAcceleratorsA
SetWindowTextA
InvalidateRect
GetMenu
CheckMenuItem
GetWindowPlacement
GetClientRect
SendMessageA
LoadMenuA
LoadCursorA
CreatePopupMenu
ReleaseDC
CreateWindowExA

gdi32

CreatePalette
CreateCompatibleDC
BitBlt
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
SelectPalette
RealizePalette
CreateDIBSection

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

wsock32

select
__WSAFDIsSet
gethostname
WSAGetLastError
bind
sendto
recvfrom
htonl
setsockopt
connect
inet_ntoa
ntohs
WSAStartup
WSACleanup
ntohl
gethostbyname
socket
htons
send
recv
closesocket

comctl32

ord17

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioRead
timeSetEvent
timeKillEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
mmioClose
mmioOpenA
mmioSetBuffer
mmioSeek

Sections

.text
Size: 960KB - Virtual size: 956KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 8.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UVA_DATA
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15045bbe7aa9305a694228debbd1aff7

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wsock32

comctl32

ddraw

dsound

winmm

Sections

.text Size: 960KB - Virtual size: 956KB

.rdata Size: 80KB - Virtual size: 77KB

.data Size: 312KB - Virtual size: 8.3MB

UVA_DATA Size: 16KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 960KB - Virtual size: 956KB

.rdata
Size: 80KB - Virtual size: 77KB

.data
Size: 312KB - Virtual size: 8.3MB

UVA_DATA
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 3KB