timeSync[.]exe | Triage™

General

Target
timeSync.exe
Size 304KB
Sample240107-e2hsysfed7
SHA256 2c32eace1b05663b289ea1ac4dc8a8934d693ee1fc1e178ed1f8052dbb3f3b98
MD5 dc76a93f65c8adbdcb788680cf0c0950
SHA1 8b9fb02052dda3350f18c7c2d848a89e3ae26c30
SHA512 4502efe37c8fb72a9db9f2c072d7cd1cbe96f1d6a1c0a65ee1dc2ad708645c86d2dddb7c129c1bcfa3ca011dfdb2818324aefcec9e7c9d72b5211d0a267d4b44
SSDEEP 3072:68lLLOIPrkS7rJikDHP7+F/pwtH9RAeZZSVyLMsFofMD2UkaR/9SJ5fTK7KVDrcz:68lLHDkSJ7XheVyoPIkrfTgYn79o6q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
timeSync.exe

File Explorer

timeSync.exe

.exe 304KB

timeSync.exe

IMPHASH de13e22fc261029836773306583464cf
SHA256 2c32eace1b05663b289ea1ac4dc8a8934d693ee1fc1e178ed1f8052dbb3f3b98
MD5 dc76a93f65c8adbdcb788680cf0c0950
SHA1 8b9fb02052dda3350f18c7c2d848a89e3ae26c30
SHA512 4502efe37c8fb72a9db9f2c072d7cd1cbe96f1d6a1c0a65ee1dc2ad708645c86d2dddb7c129c1bcfa3ca011dfdb2818324aefcec9e7c9d72b5211d0a267d4b44
SSDEEP 3072:68lLLOIPrkS7rJikDHP7+F/pwtH9RAeZZSVyLMsFofMD2UkaR/9SJ5fTK7KVDrcz:68lLHDkSJ7XheVyoPIkrfTgYn79o6q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8739

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree FreeEnvironmentStringsA GetModuleHandleW TlsSetValue GlobalAlloc IsProcessInJob WriteConsoleOutputA SetConsoleCP LeaveCriticalSection DnsHostnameToComputerNameW SetMessageWaitingIndicator SetTimeZoneInformation GetCompressedFileSizeA CompareStringW SetCurrentDirectoryA GetLastError CreateJobObjectW CreateNamedPipeA EnumDateFormatsExA OpenWaitableTimerA LoadLibraryA SetConsoleOutputCP VirtualLock AddAtomA CreateWaitableTimerW VirtualProtect QueryPerformanceFrequency LocalFree SetFileAttributesW LCMapStringW CompareStringA GetTimeZoneInformation FreeLibrary CopyFileExW GetLongPathNameA TryEnterCriticalSection GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapCreate HeapDestroy VirtualFree DeleteCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapSize SetConsoleCtrlHandler InterlockedExchange GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA SetEnvironmentVariableA

user32

GetProcessDefaultLayout

advapi32

AbortSystemShutdownA EqualSid ReadEventLogW

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mewig

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yug

Size

1024B

Virtual Size

577B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

timeSync.exe

kernel32

user32

advapi32

generic