view[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

view.exe
Size

4.0MB
MD5

d72656a154308822f673ad9fb5f07f82
SHA1

d69995c811af6b10917a500f9c7ad88a45dddaa7
SHA256

6d5381a095bd97c7796305953d83933c2b988d6e516b5ad77aa97fc06acbd6d3
SHA512

4cb9259964703e477e59f7ac90f9c33c87ce2ae91c72c67538efc6a91f00264d907d10c610463028f4963a72a421ffe78a5ad1df03afdf9934adb8f021c95373
SSDEEP

49152:KepHsLvOh1j6GSMlutOUZE0Y2NwFHzC8UNSrAdPe+rV0K6y1bnp6d6X:LdxsdPe+6An4d6X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
view.exe

Files

view.exe
.exe windows x64

1a281467a41c2b26d3e703cec440db0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetComputerNameExW
GetProcAddress
FreeLibrary
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetCurrentProcessId
SetHandleInformation
LocalFree
GetLogicalProcessorInformationEx
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
GetProcessTimes
GetExitCodeProcess
GetCurrentThreadId
lstrlenW
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockShared
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
GetLastError
HeapAlloc
OpenProcess
VerifyVersionInfoW
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
ReadProcessMemory
VerSetConditionMask
SetConsoleMode
GetConsoleMode
GetStdHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
GetSystemInfo
TlsSetValue
TlsGetValue
CreateThread
ReadConsoleW
WideCharToMultiByte
CreateFileW
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
WriteConsoleW
IsProcessorFeaturePresent
MultiByteToWideChar
GetFileAttributesW
CreateProcessW
WaitForSingleObject
GetWindowsDirectoryW
GetSystemDirectoryW
LoadLibraryA
CreateNamedPipeW
FormatMessageW
GetFullPathNameW
CloseHandle
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetModuleHandleW
GetCommandLineW
DuplicateHandle
SetFilePointerEx
WriteFileEx
SleepEx
ReadFileEx
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
GetModuleHandleA
FindNextFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW

netapi32

NetWkstaGetInfo
NetApiBufferFree
NetServerGetInfo
NetApiBufferAllocate
NetUserGetInfo
NetUserEnum
NetUserGetLocalGroups

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

ws2_32

recv
getsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
send
WSASend
setsockopt
WSAIoctl
WSAGetLastError
closesocket
WSAStartup
shutdown
WSACleanup
freeaddrinfo
getaddrinfo

advapi32

GetTokenInformation
IsValidSid
GetLengthSid
CopySid
RegOpenKeyExW
RegQueryValueExW
LookupAccountSidW
GetUserNameW
OpenProcessToken
SystemFunction036
RegCloseKey

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle
EncryptMessage
QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
InitializeSecurityContextW
LsaFreeReturnBuffer
LsaEnumerateLogonSessions
AcceptSecurityContext
DecryptMessage
ApplyControlToken
LsaGetLogonSessionData

crypt32

CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

ntdll

NtDeviceIoControlFile
NtQuerySystemInformation
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile
NtQueryInformationProcess

pdh

PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCollectQueryData
PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo
SafeArrayUnaccessData
VariantClear
SysAllocStringLen
SysStringLen
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysAllocString

iphlpapi

GetIfTable2
FreeMibTable
GetAdaptersAddresses
GetIfEntry2

bcrypt

BCryptGenRandom

psapi

GetPerformanceInfo
GetModuleFileNameExW

vcruntime140

memmove
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
__current_exception_context
memcpy
memset
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

logf
cos
tan
floorf
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_set_app_type
_initterm
_initterm_e
exit
_exit
terminate
_crt_atexit
_seh_filter_exe
__p___argc
_register_thread_local_exe_atexit_callback
_register_onexit_function
_c_exit
__p___argv
_get_initial_narrow_environment
_cexit
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a281467a41c2b26d3e703cec440db0c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

netapi32

shell32

ole32

ws2_32

advapi32

secur32

crypt32

ntdll

pdh

powrprof

oleaut32

iphlpapi

bcrypt

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 152KB - Virtual size: 152KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 152KB - Virtual size: 152KB

.reloc
Size: 26KB - Virtual size: 25KB