Patch[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Patch.exe
Size

396KB
MD5

06b8aab46a60801e1df1d09999f279fe
SHA1

3bca60df5b493ecefe7997c8c079c8b384cce79e
SHA256

e683810bc46cede7da78add723555c8a1abe4c4f7fff4118abf4c0159149d36c
SHA512

359bc1bd29c9d640ac8f254dcada592955351da07e627a7b3f41480f7cb259d9244b87bc8351d5d8fd09fdafeaf737a6bef24a5c18cbd0bec8416304252b98d5
SSDEEP

6144:hsBEZHLKNYTvj8OzRjxbQLXa+rYRzcszzzecUCn3+XOGT1:moHLKNYDnlaLXa+rYRzcszzzecUF1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Patch.exe

Files

Patch.exe
.exe windows:6 windows x64 arch:x64

e6942378f3c92a8cb278a2a8c6a1de89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

DragFinish
SHCreateItemFromParsingName

comctl32

ord413
ord412
ord410
InitCommonControlsEx
ord411

gdi32

CreateSolidBrush
CreateDIBSection
DeleteObject
CreateFontW

kernel32

GetCurrentProcessId
IsProcessorFeaturePresent
GetFileInformationByHandle
GetFileInformationByHandleEx
GetLastError
CloseHandle
GetTempPathW
GetTempFileNameW
CreateActCtxW
ActivateActCtx
DeleteFileW
LoadLibraryW
GetModuleHandleW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleA
GetProcAddress
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
RtlLookupFunctionEntry
FormatMessageW
CreateFileW
GetFullPathNameW
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
GetEnvironmentVariableW
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree

shlwapi

ord12

user32

SetWindowLongPtrW
InvalidateRect
UpdateWindow
GetClientRect
EnumChildWindows
GetMessageW
GetAncestor
IsDialogMessageW
TranslateMessage
MonitorFromWindow
PostMessageW
IsWindow
SetWindowPos
GetClassNameW
GetSubMenu
GetMenuItemID
GetWindowLongPtrW
DefWindowProcW
LoadCursorW
RegisterClassExW
DestroyIcon
GetDC
ReleaseDC
DestroyMenu
DestroyWindow
GetMenuItemCount
DeleteMenu
SetParent
AdjustWindowRectEx
CreateWindowExW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
GetParent
ShowWindow
GetMonitorInfoW
CreateIconIndirect
LoadImageW
SendMessageW
DispatchMessageW

windowscodecs

WICConvertBitmapSource

vcruntime140

memcmp
__current_exception_context
__C_specific_handler
memmove
memcpy
__CxxFrameHandler3
memset
__current_exception

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
exit
_initterm_e
_cexit
_initterm
_get_initial_narrow_environment
_configure_narrow_argv
_initialize_narrow_environment
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6942378f3c92a8cb278a2a8c6a1de89

Headers

DLL Characteristics

File Characteristics

Imports

shell32

comctl32

gdi32

kernel32

ole32

shlwapi

user32

windowscodecs

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 151KB - Virtual size: 150KB

.rdata Size: 232KB - Virtual size: 231KB

.data Size: 512B - Virtual size: 680B

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 151KB - Virtual size: 150KB

.rdata
Size: 232KB - Virtual size: 231KB

.data
Size: 512B - Virtual size: 680B

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB