aa[.]exe | Triage

Resubmissions

02/08/2023, 07:44

230802-jkvteade24 3

02/08/2023, 06:43

230802-hg4rgadc59 3

Sharing

Copy URL Twitter E-mail

General

Target

aa.exe
Size

4.2MB
MD5

ea3b66b8f49949bc1de0d919c0e2985b
SHA1

97580fcb4bed712b1b03df989202345542fa3db6
SHA256

bfe78363450de5c16d77581ebbfbb56503f10d343cd9d2fdaf19209c386278a7
SHA512

c45a138a85eb72b046bb7eace069067e4cee4bd98d81fcd51067c545cc07739b72146ef28138bec8609c75619026b15ff5fc65e3544d72a3b968a758a9ae0f0e
SSDEEP

49152:NuZJQmVgYFw/KJXmDzUOPchGIHGvBkdCd/5vA6hWNfoQrT6hngCRHctnc7Np3SWI:NmVvldCcT1CRU0KjAtR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa.exe

Files

aa.exe
.exe windows x64

9590645dfe1587a486f54e5907b4ef13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtCancelIoFileEx
NtCreateFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
RtlLookupFunctionEntry
NtReadFile
RtlCaptureContext
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx

oleaut32

SafeArrayGetLBound
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SysFreeString
SysAllocStringLen
SafeArrayDestroy

kernel32

GetSystemInfo
SetThreadStackGuarantee
SetFileCompletionNotificationModes
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
AcquireSRWLockExclusive
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
AddVectoredExceptionHandler
SleepConditionVariableSRW
SetHandleInformation
WakeConditionVariable
WakeAllConditionVariable
GetLastError
GetQueuedCompletionStatusEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SwitchToThread
TerminateProcess
HeapReAlloc
GetProcessHeap
HeapAlloc
GetCurrentProcess
GetProcAddress
LoadLibraryA
CloseHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
IsProcessorFeaturePresent
HeapFree
InitializeSListHead
IsDebuggerPresent
GetExitCodeProcess
LoadLibraryExW
GetFileInformationByHandle
WaitForSingleObject
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetOverlappedResult
WaitForMultipleObjects
ReleaseSRWLockExclusive
TlsGetValue
TlsSetValue
CopyFileExW
TlsFree
FindClose
PostQueuedCompletionStatus

ws2_32

WSAIoctl
getsockopt
getsockname
recv
send
shutdown
WSAGetLastError
getpeername
socket
closesocket
bind
listen
accept
WSASocketW
ioctlsocket
setsockopt
connect
getaddrinfo
freeaddrinfo
WSASend
WSACleanup
WSAStartup

advapi32

SystemFunction036
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW

user32

EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoW

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CryptUnprotectData
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain

secur32

FreeContextBuffer
AcquireCredentialsHandleA
DecryptMessage
FreeCredentialsHandle
EncryptMessage
DeleteSecurityContext
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken

gdi32

GetDIBits
CreateDCW
GetDeviceCaps
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetObjectW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity

api-ms-win-crt-string-l1-1-0

strcspn
strlen
strcmp
strcpy_s
strncmp
wcsncmp

api-ms-win-crt-math-l1-1-0

log
pow
_dclass
__setusermatherr

api-ms-win-crt-heap-l1-1-0

_msize
calloc
free
_set_new_mode
malloc
realloc

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e
exit
_exit
_initterm
terminate
_get_initial_narrow_environment
_configure_narrow_argv
__p___argv
_set_app_type
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_endthreadex
_beginthreadex
abort
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

9590645dfe1587a486f54e5907b4ef13

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

oleaut32

kernel32

ws2_32

advapi32

user32

bcrypt

crypt32

secur32

gdi32

ole32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 71KB - Virtual size: 70KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 71KB - Virtual size: 70KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 29KB - Virtual size: 29KB