kita[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kita.exe
Size

3.1MB
MD5

9a2543cd7173c4761ef89bd658ff23af
SHA1

2084088dd0cfee1d09749ff9fd019d6426f2a945
SHA256

9d854bb6e82b757d7ec45eefd80e83113920a25bb75c58a74bb19984319adbea
SHA512

d599b1a22107fa9b5e71511c4fcfc5167ab33d7906b9313fcc1fb93862aa62f05cb31675dd6479fdf9fe8d741283eacb5408927813ea70b5ee1d798b39025fc4
SSDEEP

98304:pVQB/oZ7gYjdDMXhH/XHn+2e14L6d0JiA1VIzuYX//R/:PQB/oZKf+WLZD1OzuYX3d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kita.exe

Files

kita.exe
.exe windows x86

0fc67d303248275f656546b6fa4c11de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileInformationByHandle
GetDriveTypeA
FindFirstFileExA
GetCurrentDirectoryW
ActivateActCtx
DeactivateActCtx
SetLastError
Sleep
GetTempPathA
GetTickCount
GetVersion
GetLocaleInfoA
GlobalAddAtomA
GetModuleHandleA
DeleteAtom
DeleteFileA
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcatA
SystemTimeToFileTime
ReadFile
SetFilePointer
GlobalSize
FindResourceA
LoadLibraryA
FreeLibrary
CreateEventA
GetProcAddress
ResetEvent
SetEvent
lstrcpyA
GlobalGetAtomNameA
MulDiv
lstrcmpA
GlobalMemoryStatusEx
CreateFileA
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CloseHandle
FindFirstFileA
FindClose
GetLastError
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
lstrcmpiA
OpenFile
GetLocalTime
GetUserDefaultLCID
EnumDateFormatsA
EnumTimeFormatsA
GetTimeFormatA
GetDateFormatA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenA
WideCharToMultiByte
FindResourceW
GetDriveTypeW
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEnvironmentVariableA
GetProcessHeap
CreateFileW
WriteConsoleW
GetTimeZoneInformation
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
IsValidLocale
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
EnumSystemLocalesA
FreeResource
lstrlenW
LocalFree
FormatMessageA
CopyFileA
lstrcmpW
LoadLibraryW
CompareStringA
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomA
GetCurrentThreadId
GetModuleFileNameA
GetCurrentProcessId
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
GetFileAttributesExA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
GetProfileIntA
SetThreadPriority
ResumeThread
WaitForSingleObject
SuspendThread
GetModuleHandleW
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
InterlockedExchange
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
GlobalFlags
GetACP
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetCPInfo
GetOEMCP
FindResourceExW
GetTempFileNameA
SetErrorMode
GetWindowsDirectoryA
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
SearchPathA
RtlUnwind
DecodePointer
EncodePointer
RaiseException
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapQueryInformation
HeapSize
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetLocaleInfoW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
IsValidCodePage
CompareStringW
LCMapStringW
HeapCreate

user32

ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
TrackPopupMenu
ScrollWindow
MapWindowPoints
GetMonitorInfoA
MonitorFromWindow
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
DispatchMessageA
GetLastActivePopup
GetForegroundWindow
RemovePropA
GetPropA
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowThreadProcessId
GetAsyncKeyState
MapDialogRect
MessageBeep
IsClipboardFormatAvailable
CountClipboardFormats
IsRectEmpty
SendNotifyMessageA
CopyAcceleratorTableA
InflateRect
GetMenuItemInfoA
DestroyMenu
SystemParametersInfoA
CharUpperA
GetKeyNameTextA
MapVirtualKeyA
SetTimer
KillTimer
WindowFromPoint
CreateMenu
PostThreadMessageA
ClipCursor
SetParent
MonitorFromPoint
DeleteMenu
GetSystemMenu
TranslateAcceleratorA
InsertMenuItemA
IsIconic
LoadAcceleratorsA
SetCursor
DestroyIcon
LoadMenuA
ReuseDDElParam
UnpackDDElParam
IsZoomed
ShowOwnedPopups
ValidateRect
TranslateMessage
GetMessageA
DeferWindowPos
PostQuitMessage
RealChildWindowFromPoint
GetSysColorBrush
UnregisterClassA
LoadCursorW
WaitMessage
GetDCEx
LockWindowUpdate
EnumDisplayMonitors
SetLayeredWindowAttributes
UnionRect
GetTabbedTextExtentW
LoadAcceleratorsW
LoadMenuW
GetMenuDefaultItem
InvertRect
HideCaret
EnableScrollBar
NotifyWinEvent
GetIconInfo
CopyImage
GetNextDlgGroupItem
DrawIconEx
IsWindowVisible
DestroyAcceleratorTable
SetClassLongA
DrawStateA
DrawEdge
DrawFrameControl
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableA
SetCursorPos
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
IsCharLowerA
MapVirtualKeyExA
UpdateLayeredWindow
IsMenu
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
SetMenuDefaultItem
FrameRect
GetUpdateRect
CopyIcon
CharUpperBuffA
GetDoubleClickTime
SubtractRect
DrawIcon
DestroyCursor
GetWindowRgn
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
EndPaint
BeginPaint
GetWindowDC
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetWindowTextLengthA
SetWindowPos
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
CheckDlgButton
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
OemToCharA
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
IsWindowEnabled
EndDialog
TabbedTextOutA
DrawTextExA
GrayStringA
GetSystemMetrics
LoadIconA
WinHelpA
CopyRect
FillRect
DrawFocusRect
CreatePopupMenu
AppendMenuA
GetSysColor
SetWindowTextA
GetWindowTextA
IsChild
GetFocus
GetWindowRect
GetNextDlgTabItem
GetParent
wsprintfA
GetKeyState
BringWindowToTop
InvalidateRect
PtInRect
PostMessageA
MessageBoxA
CreateWindowExA
GetClassInfoExA
RegisterClassA
SetWindowRgn
AdjustWindowRectEx
EnableWindow
SendMessageA
DrawTextA
UpdateWindow
GetClassInfoA
PeekMessageA
MsgWaitForMultipleObjects
CharToOemA
SetRect
GetDlgItem
CharToOemBuffA
WindowFromDC
SetFocus
LoadImageA
RedrawWindow
RegisterWindowMessageA
GetCursorPos
ReleaseDC
GetDC
EnumWindows
LoadIconW
IntersectRect
RegisterClipboardFormatA
GetClassNameA
SendMessageTimeoutA
SetForegroundWindow
ReleaseCapture
LoadBitmapA
GetCapture
LoadCursorA
SetCapture
ScreenToClient
ClientToScreen
GetClientRect
EqualRect
OffsetRect
SetRectEmpty
OemToCharBuffA

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
SelectPalette
GetObjectType
CreateHatchBrush
DPtoLP
GetWindowOrgEx
GetCharWidthA
CreateFontA
StretchDIBits
CreateCompatibleBitmap
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
GetPixel
GetTextColor
GetWindowExtEx
GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
LPtoDP
GetRgnBox
OffsetRgn
SetPixel
StretchBlt
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetSystemPaletteEntries
CreateFontIndirectA
CreateICA
GetDeviceCaps
GetTextExtentPoint32A
GetTextMetricsA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetPaletteEntries
GetBkColor
CloseMetaFile
Rectangle
GetStockObject
CreateSolidBrush
CreateCompatibleDC
BitBlt
EnumFontFamiliesA
EnumFontFamiliesExA
DeleteObject
CreatePen
SelectObject
GetObjectA
SetTextColor
SetROP2
SetPolyFillMode
RealizePalette
GetNearestPaletteIndex
CreatePalette
GetTextAlign
GetTextCharsetInfo
CreateDIBitmap
UnrealizeObject
GetMapMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
CreateMetaFileA
SetBrushOrgEx
PatBlt
GetViewportExtEx
CombineRgn
SetRectRgn
DeleteMetaFile
CreateRectRgnIndirect

advapi32

RegOpenKeyExW
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegSetValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegEnumValueA
CryptImportKey

shell32

SHAppBarMessage
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFileInfoA
ExtractIconA
DragAcceptFiles
ShellExecuteA
ShellAboutA
DragFinish
DragQueryFileA

ole32

OleSetMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleRegEnumVerbs
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
CoDisconnectObject
CoCreateGuid
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoCreateInstance
CoInitializeEx
OleGetClipboard
DoDragDrop
CoInitialize
GetRunningObjectTable
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleLockRunning
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleSave
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleDuplicateData
CoTaskMemAlloc
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
ReleaseStgMedium
OleInitialize
OleUninitialize
CreateFileMoniker
StgOpenStorage

msimg32

TransparentBlt
AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathStripToRootA
PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW
PathIsUNCA

oledlg

ord4
ord3
ord11

wldap32

ord60
ord143
ord211
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord22
ord27
ord46
ord41

ws2_32

accept
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
recvfrom
__WSAFDIsSet
WSACleanup
WSAStartup
WSASetLastError
WSAGetLastError
select
recv
send
WSAIoctl
listen
ioctlsocket
gethostname
htonl
ntohl
setsockopt

crypt32

CertFreeCertificateContext

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipCreateBitmapFromHBITMAP
GdipGetImagePalette

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comdlg32

GetFileTitleA

oleaut32

SysAllocString
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 354KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fc67d303248275f656546b6fa4c11de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

msimg32

comctl32

shlwapi

oledlg

wldap32

ws2_32

crypt32

oleacc

gdiplus

imm32

winmm

winspool.drv

comdlg32

oleaut32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 354KB - Virtual size: 353KB

.data Size: 26KB - Virtual size: 57KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 354KB - Virtual size: 353KB

.data
Size: 26KB - Virtual size: 57KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB