client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
client.exe
Size 3.4MB
Sample240108-a4l6yaade5
SHA256 16b3042e7c522e69590c5d65d83c6775ccb90d5cc0adaa9a0ac31bc9bdb4c444
MD5 51042974e4b3ccec5de0703dfd95e765
SHA1 d75083d6b6c8dd259fc87f88406461ccb82f2a9f
SHA512 a57d75d6c2c1478bdd647a01836d1893033ad49b6808cc4b39a205566133733195312f3db931a5ab07e0e9641f7dd23fcab24a80c9df34414f01e8813e28445f
SSDEEP 49152:4ia/Uqw5B+UDfdegvc8nFEvBvSWLEeonTkGmuMLSzTeI0HXNYiqEvBvSWLEeonTr:HReU8vkMGmuCSzT4dzvkMGmuCSzT4d4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 3.4MB

client.exe

IMPHASH 9a2596d6384100e353024db04ef96354
SHA256 16b3042e7c522e69590c5d65d83c6775ccb90d5cc0adaa9a0ac31bc9bdb4c444
MD5 51042974e4b3ccec5de0703dfd95e765
SHA1 d75083d6b6c8dd259fc87f88406461ccb82f2a9f
SHA512 a57d75d6c2c1478bdd647a01836d1893033ad49b6808cc4b39a205566133733195312f3db931a5ab07e0e9641f7dd23fcab24a80c9df34414f01e8813e28445f
SSDEEP 49152:4ia/Uqw5B+UDfdegvc8nFEvBvSWLEeonTkGmuMLSzTeI0HXNYiqEvBvSWLEeonTr:HReU8vkMGmuCSzT4dzvkMGmuCSzT4d4
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

615272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

ws2_32

connect htons inet_addr send recv WSAGetLastError WSAStartup socket

kernel32

GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress LoadLibraryA GetCommandLineW CreateDirectoryA CloseHandle ReleaseMutex WaitForSingleObjectEx Sleep CreateRemoteThread ResumeThread GetThreadContext SetThreadContext GlobalMemoryStatusEx GetSystemInfo GetModuleHandleA lstrcatW OpenMutexA GetModuleHandleW GetProcessId OpenProcess VirtualAllocEx WriteProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32EnumProcessModulesEx K32GetModuleFileNameExA EnterCriticalSection LeaveCriticalSection GetACP FindClose DeleteCriticalSection IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc DeleteFileW GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapAlloc HeapFree WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread ReadFile RtlUnwind LoadLibraryExW FreeLibrary TlsFree TlsSetValue GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW TlsGetValue TlsAlloc HeapSize SetEndOfFile InitializeCriticalSection SetLastError GetLastError GetCurrentThreadId WriteConsoleW InitializeCriticalSectionEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException

user32

OpenClipboard CloseClipboard GetDesktopWindow GetWindowRect SetForegroundWindow UpdateWindow MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow ReleaseCapture SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData

advapi32

GetCurrentHwProfileA RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptGenRandom CryptReleaseContext

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathGetArgsW

Name

.text

Size

790KB

Virtual Size

789KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client.exe

d3d9

d3dx9_43

ws2_32

kernel32

user32

advapi32

shell32

imm32

dwmapi

shlwapi

generic