Patcher[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Patcher.exe
Size

758KB
MD5

bd3929b321d2c510738599314baf2262
SHA1

0162669df009c5c53fa8c87a5ae9a5f253353f53
SHA256

45679b95db7065916c9dd12479f6bb9c696e2df792a45f439bcbca1a997c7ba8
SHA512

22dc53780b103c5f62850c2b8fd09e80a0bb6553c7c362227e4d174c740dfaf90cbb0ee8e8012d8f6ca5e275ee435c74015aebcdf544e941303812bdfea065fa
SSDEEP

12288:JHIhPacZ5640HM6NYLTwuHbYTQJ9nqcHnb/akre+yA43TM91T4pGNKm1k:ipacZQM6NYtHbYTejb/akyFTMzTUGNKL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Patcher.exe

Files

Patcher.exe
.exe windows:6 windows x86

9e6a26b6209729454beed331878967c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
FreeLibrary
lstrcmpiW
GlobalUnlock
lstrcmpW
MulDiv
LoadLibraryExW
ReadFile
GetModuleHandleW
CloseHandle
DeleteFileW
FormatMessageW
Sleep
CreateFileW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WriteFile
GetProcAddress
SetStdHandle
SetEnvironmentVariableW
GetFileAttributesExW
CreateDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
VirtualQuery
VirtualProtect
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
MoveFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileInformationByHandle
FindResourceW
LoadResource
RaiseException
GlobalAlloc
MultiByteToWideChar
SetLastError
SizeofResource
OpenMutexW
WaitForSingleObject
CreateMutexW
GetPrivateProfileIntW
SetCurrentDirectoryW
GetModuleFileNameW
GetTickCount
GetCurrentDirectoryW
GetPrivateProfileStringW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
DecodePointer
GetLastError
InitializeCriticalSection
CompareStringW
InitializeCriticalSectionAndSpinCount
MoveFileExW
ExitProcess
FlushFileBuffers
SetFilePointerEx
GetSystemInfo
SetEndOfFile
QueryPerformanceCounter
GetTimeZoneInformation
TlsFree
TlsGetValue
GetCurrentProcessId
ResetEvent
TlsAlloc
SetEvent
CreateEventW
ReleaseMutex
InitializeCriticalSectionEx
EncodePointer
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
SetFilePointer
GetFileSize
TerminateProcess
GetACP
GetStdHandle
GetSystemTimeAsFileTime
TlsSetValue
ReleaseSemaphore

user32

ShowWindow
OffsetRect
DrawTextW
ReleaseDC
UnregisterClassW
CreateWindowExW
SetWindowPos
GetDC
DestroyWindow
GetWindowRect
EndPaint
BeginPaint
GetCursorPos
InvalidateRect
PostQuitMessage
LoadIconW
ScreenToClient
EndDialog
SetLayeredWindowAttributes
AdjustWindowRectEx
GetSystemMetrics
SetClassLongW
DispatchMessageW
PeekMessageW
TranslateMessage
UpdateWindow
GetWindowLongW
GetWindowTextLengthW
CallWindowProcW
GetWindow
GetFocus
FillRect
SetWindowTextW
RegisterClassExW
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDesktopWindow
GetClassInfoExW
GetParent
RegisterWindowMessageW
ReleaseCapture
MessageBoxW
CreateDialogParamW
PostMessageW
GetWindowTextW
GetDlgItem
SetRect
EnableWindow
SendMessageW
DefWindowProcW

gdi32

GetStockObject
GetDeviceCaps
CreateSolidBrush
SetBkColor
CreateDIBSection
StretchBlt
GetObjectW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateFontW
DeleteDC
SetTextColor
SetBkMode
DeleteObject

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

ShellExecuteW

ole32

StringFromGUID2
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
OleLockRunning
CLSIDFromString
CoTaskMemAlloc
OleUninitialize
CoGetClassObject
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysFreeString
OleCreateFontIndirect
VariantClear
SysAllocStringLen
SysStringLen
DispCallFunc
LoadTypeLi
LoadRegTypeLi
VariantInit
SysAllocString

wininet

InternetCloseHandle
InternetAttemptConnect
InternetReadFile
HttpSendRequestW
InternetConnectW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
HttpOpenRequestW

msimg32

TransparentBlt

Sections

.text
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e6a26b6209729454beed331878967c8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

msimg32

Sections

.text Size: 562KB - Virtual size: 561KB

.rdata Size: 137KB - Virtual size: 136KB

.data Size: 13KB - Virtual size: 33KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 562KB - Virtual size: 561KB

.rdata
Size: 137KB - Virtual size: 136KB

.data
Size: 13KB - Virtual size: 33KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 31KB - Virtual size: 30KB