11[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
11.exe
Size 904KB
Sample231029-kgetfsgg85
SHA256 a0762a63b9deea8f379d3fe5a2ce0139bb30be3e8bd004ed59defcfa69132105
MD5 ec6101acbf2b50bb868589253bd850d4
SHA1 5003bd943d48d2ed38f0f16d7bfe4526cf6b5a9f
SHA512 1fe2aca315d654d8fd7d1e67547b7698a32777c749d2e379e3b5b48af2ea2803073c8e4444566b3b804732309b3eb18a7f258a38b86fb2da25d93b0fa66a142d
SSDEEP 12288:4aSFnXytmoMWMk7/RdRwRoF/LmwbTpYOUGVNG1mlG1qu9S:4lnXySWP7/PR2o1p/rGc41H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11.exe

File Explorer

11.exe

.exe 904KB

11.exe

IMPHASH 208ce0bd6d4ec9e76be47392f7479029
SHA256 a0762a63b9deea8f379d3fe5a2ce0139bb30be3e8bd004ed59defcfa69132105
MD5 ec6101acbf2b50bb868589253bd850d4
SHA1 5003bd943d48d2ed38f0f16d7bfe4526cf6b5a9f
SHA512 1fe2aca315d654d8fd7d1e67547b7698a32777c749d2e379e3b5b48af2ea2803073c8e4444566b3b804732309b3eb18a7f258a38b86fb2da25d93b0fa66a142d
SSDEEP 12288:4aSFnXytmoMWMk7/RdRwRoF/LmwbTpYOUGVNG1mlG1qu9S:4lnXySWP7/PR2o1p/rGc41H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

530321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

midiStreamOut midiOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamProperty midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutUnprepareHeader waveOutRestart waveOutPrepareHeader

ws2_32

WSACleanup inet_ntoa closesocket getpeername accept ntohl WSAAsyncSelect recvfrom ioctlsocket recv

kernel32

OpenProcess GetWindowsDirectoryA GetSystemDirectoryA SetLastError GetTimeZoneInformation GetVersion TerminateThread CreateMutexA TerminateProcess SuspendThread UnhandledExceptionFilter GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetCurrentProcess GetFileSize SetFilePointer CreateToolhelp32Snapshot Process32First Process32Next CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA InterlockedExchange GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc MultiByteToWideChar WideCharToMultiByte GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle ReleaseMutex

user32

DestroyAcceleratorTable GetWindow GetActiveWindow SetFocus IsIconic PeekMessageA SetMenu GetMenu SetWindowRgn GetMessagePos ScreenToClient GetSysColorBrush GetKeyState TranslateAcceleratorA IsWindowEnabled ShowWindow SystemParametersInfoA LoadImageA EnumDisplaySettingsA ClientToScreen EnableMenuItem GetSubMenu GetDlgCtrlID CreateAcceleratorTableA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx SetRectEmpty DispatchMessageA GetMessageA ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos LoadStringA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem SetRect InflateRect IntersectRect DeleteMenu PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA GetSystemMenu WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl TranslateMessage LoadIconA GetDesktopWindow GetClassNameA GetWindowThreadProcessId FindWindowA GetDlgItem GetWindowTextA GetForegroundWindow DefWindowProcA GetClassInfoA IsZoomed PostQuitMessage DestroyIcon CopyAcceleratorTableA UnregisterClassA RegisterClipboardFormatA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow

gdi32

GetViewportExtEx ExtSelectClipRgn LineTo MoveToEx ExcludeClipRect GetClipBox GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP PtVisible GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen GetObjectA SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn SetBkMode RestoreDC SaveDC PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette GetSystemPaletteEntries DPtoLP StretchBlt CreatePalette

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyA RegDeleteValueA RegDeleteKeyA RegQueryValueA RegCreateKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi RegisterTypeLi UnRegisterTypeLi

comctl32

ord17 ImageList_Destroy

comdlg32

ChooseColorA GetFileTitleA GetSaveFileNameA GetOpenFileNameA