KoH[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

KoH.exe
Size

5.4MB
MD5

f70cc443607bfdcbf1e6ce4a6e6e4646
SHA1

80635a19cd05eebae5399854b8a16d2c3e796147
SHA256

80cfd422daa5bc734a4d60721f58defea16489ae640d1024c4af553405d84a79
SHA512

199e4dbfa385189374ab98a3fc93a34463d7bcc65b6062793e2dabb9be29044542070db52da83632571b80ef69ee090d85e4c77dde8c89ee1c357fe8d4296122
SSDEEP

98304:b/LHtf3SO3pxNd5C3BP7w3i9/SEWU/AcM:b/rtfiO3TNdk3tw3ilSCAc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KoH.exe

Files

KoH.exe
.exe windows x86

d97ca4e7f6fa1b9edfbcf184e5e45ce5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkWait@4
_BinkOpen@8
_BinkSetSoundTrack@8
_BinkSetSoundSystem@8
_BinkOpenDirectSound@4
_BinkNextFrame@4
_BinkCopyToBuffer@28
_BinkDoFrame@4
_BinkClose@4

dsound

ord2
ord11

imm32

ImmGetContext
ImmNotifyIME
ImmReleaseContext
ImmGetCompositionStringA
ImmSetCompositionWindow
ImmGetProperty
ImmGetCompositionStringW

avifil32

AVIStreamSetFormat
AVIStreamRelease
AVIFileRelease
AVIFileExit
AVISaveOptions
AVIMakeCompressedStream
AVIFileCreateStreamA
AVIStreamWrite
AVIFileInit
AVIFileOpenA

msvfw32

ord2

kernel32

MapViewOfFile
UnmapViewOfFile
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
GetFileSize
SetFilePointer
FileTimeToSystemTime
GetFileTime
SetFileTime
SystemTimeToFileTime
SetEndOfFile
FindClose
GetLastError
ReadFile
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
IsDebuggerPresent
DebugBreak
RaiseException
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
GetCommandLineA
GetCurrentThreadId
GetTickCount
GetSystemTime
GetLocaleInfoA
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
CreateFileMappingA
CreateFileMappingW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
SetCurrentDirectoryA
SetCurrentDirectoryW
OutputDebugStringA
OutputDebugStringW
CreateSemaphoreA
CreateSemaphoreW
MoveFileA
HeapAlloc
LoadLibraryA
LoadLibraryW
GetProcAddress
HeapFree
GetVersionExA
GetVersionExW
GetTempFileNameA
GetTempFileNameW
CreateProcessA
CreateProcessW
GetShortPathNameA
GetShortPathNameW
VirtualAlloc
VirtualProtect
VirtualFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
TerminateThread
Sleep
CreateThread
FreeLibrary
WaitForSingleObject
SetUnhandledExceptionFilter
ReleaseSemaphore
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
OpenMutexA
OpenMutexW
Beep
GetDiskFreeSpaceExA
IsBadReadPtr
ExitProcess
GetModuleHandleA
TerminateProcess
HeapReAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetStartupInfoA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
IsBadWritePtr
VirtualQuery
HeapSize
InterlockedExchange
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
SetStdHandle
GetStringTypeA
GetStringTypeW
MoveFileW

user32

EndDialog
IsIconic
UpdateWindow
RedrawWindow
DestroyWindow
CheckDlgButton
IsDlgButtonChecked
SetRect
GetClipboardData
CloseClipboard
EnumDisplaySettingsW
EnumDisplaySettingsA
GetDlgItemTextW
GetDlgItemTextA
CreateDialogParamW
CreateDialogParamA
SetWindowTextW
SetWindowTextA
SendDlgItemMessageW
SendDlgItemMessageA
SetDlgItemTextW
SetDlgItemTextA
DialogBoxParamW
DialogBoxParamA
LoadCursorW
LoadCursorA
SetFocus
EnableWindow
ShowCursor
DestroyCursor
OpenClipboard
SetClipboardData
EmptyClipboard
DefWindowProcW
DefWindowProcA
LoadCursorFromFileW
LoadCursorFromFileA
ChangeDisplaySettingsW
ChangeDisplaySettingsA
DispatchMessageW
DispatchMessageA
PeekMessageW
PeekMessageA
RegisterClassW
RegisterClassA
MapVirtualKeyW
MapVirtualKeyA
CreateWindowExW
CreateWindowExA
MessageBoxW
MessageBoxA
MoveWindow
SetCursor
GetKeyboardLayout
GetSystemMetrics
GetForegroundWindow
ShowWindow
SetForegroundWindow
GetKeyState
TranslateMessage
WaitMessage
GetDC
ReleaseDC
WindowFromPoint
GetClientRect
ScreenToClient
ReleaseCapture
SetCapture
IsClipboardFormatAvailable
GetDlgItem
GetCursorPos

gdi32

SetStretchBltMode
SetDIBitsToDevice
StretchDIBits

comdlg32

GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
ChooseColorA

advapi32

RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA
SHGetPathFromIDListW
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathW

ws2_32

socket
__WSAFDIsSet
select
inet_ntoa
send
recv
inet_addr
WSAStartup
getsockopt
WSAAccept
setsockopt
WSACreateEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
ntohl
ntohs
getpeername
getsockname
ioctlsocket
recvfrom
WSARecvFrom
sendto
WSASendTo
connect
listen
bind
WSAEventSelect
WSACloseEvent
WSASocketA
WSAIoctl
closesocket
htonl
htons
gethostbyaddr
WSAGetLastError
gethostname
gethostbyname
WSACleanup
WSAAddressToStringW
WSAAddressToStringA
WSAStringToAddressW
WSAStringToAddressA

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 869KB - Virtual size: 869KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d97ca4e7f6fa1b9edfbcf184e5e45ce5

Headers

File Characteristics

Imports

binkw32

dsound

imm32

avifil32

msvfw32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ws2_32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 869KB - Virtual size: 869KB

.data Size: 70KB - Virtual size: 1.3MB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 636KB - Virtual size: 635KB

.reloc Size: 363KB - Virtual size: 362KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 869KB - Virtual size: 869KB

.data
Size: 70KB - Virtual size: 1.3MB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 636KB - Virtual size: 635KB

.reloc
Size: 363KB - Virtual size: 362KB