tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

1.2MB
MD5

83c832c0e7ce0be536181e42d2e727e3
SHA1

3ab7559b98e8aa1a7c5f3aaf1424652e5b2c2d0d
SHA256

2d9ba9a9c72e57860494d0c85e8a20000f8ab309e2fb5876a767c904e288f524
SHA512

7f3abd7298292dd04c22e5e959ed26f0ce3e521186d41dc9a628ae5602dc348b6764694e68a3a259344676e06403ac47823c5d057c604288d497069613eaf9a9
SSDEEP

24576:cNLRPocqIztVkflucccBOVrQW9/7WXpi9EMcppYpTTLJAQn6529Oak:gRPVaJbwwpYEdpYpTTLJnH4

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows:6 windows x86

57be97b2c63944d046ac7ef037dcb0fd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/03/2021, 00:00

Not After

05/06/2024, 23:59

Subject

CN=Micro-Star International CO.\, LTD.,O=Micro-Star International CO.\, LTD.,L=Zhonghe District,ST=New Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4f:0e:6e:48:11:b6:d9:a2:ef:64:79:7e:5f:e4:dd:aa:3d:2f:cd:66
Signer

Actual PE Digest

4f:0e:6e:48:11:b6:d9:a2:ef:64:79:7e:5f:e4:dd:aa:3d:2f:cd:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateFile
NtDeviceIoControlFile
NtQuerySystemInformation
RtlNtStatusToDosError
NtCancelIoFileEx
NtWriteFile
RtlUnwind

kernel32

GetCurrentProcess
GetCurrentThreadId
ReleaseSRWLockExclusive
SwitchToThread
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
TlsGetValue
TlsSetValue
HeapReAlloc
GetModuleHandleA
GetProcessHeap
GetModuleHandleW
FormatMessageW
GetConsoleMode
GetStdHandle
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CompareStringOrdinal
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
SetThreadStackGuarantee
GetCurrentThread
SetLastError
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
GetFullPathNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
ReleaseSRWLockShared
FindClose
CreateDirectoryW
GetSystemInfo
AddVectoredExceptionHandler
AcquireSRWLockShared
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcessId
CreateNamedPipeW
DuplicateHandle
GetQueuedCompletionStatusEx
InitializeSListHead
GetExitCodeProcess
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CopyFileExW
SetHandleInformation
GetProcessTimes
OpenProcess
IsDebuggerPresent
GetSystemTimes
GetProcessIoCounters
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
IsProcessorFeaturePresent
GlobalMemoryStatusEx
TerminateProcess
CreateIoCompletionPort
GetLogicalDrives
FindFirstFileW
GetTickCount64
GetLastError
CreateFileA
Sleep
GetProcAddress
LoadLibraryA
CloseHandle
PostQueuedCompletionStatus
HeapFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
SetFileCompletionNotificationModes
HeapAlloc
GetWindowsDirectoryW

advapi32

IsValidSid
GetTokenInformation
RegSetValueExA
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
RegCreateKeyExA
GetLengthSid
CopySid
LookupAccountSidW

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

iphlpapi

GetIfEntry2
FreeMibTable
GetAdaptersAddresses
GetIfTable2

netapi32

NetUserGetInfo
NetApiBufferFree
NetUserGetLocalGroups
NetUserEnum

secur32

AcquireCredentialsHandleA
LsaEnumerateLogonSessions
ApplyControlToken
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
QueryContextAttributesW
EncryptMessage
LsaFreeReturnBuffer
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
LsaGetLogonSessionData

pdh

PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCollectQueryData
PdhRemoveCounter
PdhCloseQuery
PdhAddEnglishCounterW

ws2_32

WSAGetLastError
freeaddrinfo
getpeername
WSAIoctl
getaddrinfo
WSAStartup
closesocket
WSASocketW
WSACleanup
ioctlsocket
setsockopt
getsockopt
recv
send
shutdown
WSASend
getsockname
bind
connect

crypt32

CertDuplicateStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateChain
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW
GetPerformanceInfo

powrprof

CallNtPowerInformation

oleaut32

VariantClear
SysFreeString
SysAllocString

api-ms-win-crt-heap-l1-1-0

free
calloc
realloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_c_exit
_initialize_narrow_environment
_get_initial_narrow_environment
abort
_initterm
_cexit
_initterm_e
_register_onexit_function
_crt_atexit
_set_app_type
_seh_filter_exe
__p___argc
_register_thread_local_exe_atexit_callback
_controlfp_s
_exit
exit
terminate
__p___argv
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcsncmp

Sections

.text
Size: 701KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57be97b2c63944d046ac7ef037dcb0fd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75Certificate

Extended Key Usages

Key Usages

4f:0e:6e:48:11:b6:d9:a2:ef:64:79:7e:5f:e4:dd:aa:3d:2f:cd:66Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

ole32

iphlpapi

netapi32

secur32

pdh

ws2_32

crypt32

bcrypt

psapi

powrprof

oleaut32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 701KB - Virtual size: 701KB

.rdata Size: 488KB - Virtual size: 487KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 14KB - Virtual size: 13KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
Certificate

4f:0e:6e:48:11:b6:d9:a2:ef:64:79:7e:5f:e4:dd:aa:3d:2f:cd:66
Signer

.text
Size: 701KB - Virtual size: 701KB

.rdata
Size: 488KB - Virtual size: 487KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 14KB - Virtual size: 13KB