h1-mod[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

h1-mod.exe
Size

11.5MB
MD5

a4c890e537500b669bb9eb26ff5cbf63
SHA1

742094717e8e24dc6c15e3b147a3fea77efc3fe5
SHA256

71bd36c9529f6b47e393dc14cb27c531a03bb2381954439d0727ac32ccd9dc54
SHA512

a12821ca3b90463b6356dcd2d546a96aa34e672793913ed1bba74973905939acb911c8ed8adc6e910a75bc68361ccc0919a2070d1e9310b69f1578bf17b668bc
SSDEEP

196608:UHfNkC4gz7fSRpnYbHru4kkq4nvya+qG5p:O4gzDSRNYbznvnF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h1-mod.exe

Files

h1-mod.exe
.exe windows:6 windows x64 arch:x64

96c2602be2908d484ec3d177b6afdbd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CryptProtectData
CertAddCertificateContextToStore

kernel32

DecodePointer
DeleteCriticalSection
GetTickCount64
GetLastError
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
MapViewOfFile
CreateFileMappingW
GetSystemInfo
UnmapViewOfFile
VirtualFree
InitializeCriticalSection
AddVectoredExceptionHandler
GetProcAddress
GetVolumeInformationA
LocalFree
InitializeCriticalSectionEx
FlushInstructionCache
GetCurrentProcess
GetCommandLineA
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleCursorPosition
GetConsoleCursorInfo
SetConsoleCursorInfo
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
DeleteFileW
CreatePipe
GetExitCodeProcess
WaitForSingleObject
SetEndOfFile
VirtualProtect
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcessId
GetCurrentDirectoryA
CreateProcessA
SetThreadExecutionState
GetPriorityClass
SetPriorityClass
VirtualAlloc
GetModuleFileNameW
SetStdHandle
HeapQueryInformation
HeapSize
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
CreateProcessW
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
GetModuleHandleA
CloseHandle
CreateFileA
SetUnhandledExceptionFilter
GetVersionExA
TerminateProcess
GetCurrentThreadId
SetEvent
CreateEventA
SetConsoleTitleA
ReadConsoleInputA
GetConsoleWindow
SetEnvironmentVariableW
DuplicateHandle
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
LCMapStringEx
GetSystemTimeAsFileTime
OutputDebugStringA
SetLastError
FormatMessageW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
SleepEx
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
Sleep
QueryPerformanceCounter
GetTickCount
MoveFileExA
ReadFile
SetConsoleTextAttribute
PeekNamedPipe
GetFileType
WaitForSingleObjectEx
GetFileSizeEx
WriteFile
CreateFileW
WaitNamedPipeW
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
LoadLibraryExA
FormatMessageA
VirtualQuery
SizeofResource
FindResourceA
LockResource
LoadResource
GlobalLock
GlobalUnlock
GetSystemFirmwareTable
MoveFileA
DeleteFileA
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
SetFilePointer
GetTempPathA
GetTempFileNameA
FlushFileBuffers
GetCommandLineW
IsDebuggerPresent
OutputDebugStringW
RaiseException
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
DeviceIoControl
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
GetExitCodeThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
IsProcessorFeaturePresent
EncodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
WaitForMultipleObjects

user32

GetSystemMetrics
CreateWindowExA
SendMessageA
GetWindowRect
AdjustWindowRect
OpenClipboard
CloseClipboard
GetClipboardData
SetWindowPos
UpdateWindow
FindWindowA
GetClientRect
RegisterClassExA
GetMessageA
MoveWindow
LoadCursorA
SetWindowLongPtrA
GetWindowLongPtrA
SystemParametersInfoA
DefWindowProcA
RegisterClassA
LoadImageA
MessageBoxA
ShowCursor
DispatchMessageA
TranslateMessage
PeekMessageA
IsWindow
MsgWaitForMultipleObjects
GetShellWindow
GetWindowThreadProcessId
ShowWindow
UnregisterClassA
DestroyIcon
DestroyWindow
PostQuitMessage
LoadIconA

gdi32

DeleteObject

advapi32

CryptAcquireContextW
CryptGenRandom
RegCreateKeyExW
RegSetValueExW
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
GetUserNameA
RegCreateKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetCurrentHwProfileA
RegCreateKeyExA
RegSetKeyValueA

shell32

CommandLineToArgvW
ShellExecuteA
SHGetKnownFolderPath

ole32

CoGetClassObject
CoUninitialize
CoInitializeEx
OleUninitialize
OleInitialize
OleSetContainedObject
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayAccessData
VariantInit
VariantClear

ntdll

NtQueryObject
RtlPcToFileHeader

ws2_32

htonl
accept
getaddrinfo
freeaddrinfo
getpeername
getsockname
gethostbyname
connect
closesocket
send
WSASetLastError
listen
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
ntohs
socket
setsockopt
bind
htons
WSAStartup
WSACleanup
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
getsockopt
WSAIoctl
gethostname

bcrypt

BCryptGenRandom

dbghelp

MiniDumpWriteDump

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
SteamAPI_GetSteamInstallPath
SteamAPI_Init
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamApps
SteamFriends
SteamGameServer
SteamGameServer_Init
SteamGameServer_RunCallbacks
SteamGameServer_Shutdown
SteamMatchmaking
SteamNetworking
SteamRemoteStorage
SteamUser
SteamUserStats
SteamUtils

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 226KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96c2602be2908d484ec3d177b6afdbd4

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

ws2_32

bcrypt

dbghelp

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.data Size: 226KB - Virtual size: 561KB

.pdata Size: 205KB - Virtual size: 204KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 4.6MB - Virtual size: 4.6MB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 226KB - Virtual size: 561KB

.pdata
Size: 205KB - Virtual size: 204KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 4.6MB - Virtual size: 4.6MB