Kayflockmp4[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Kayflockmp4.exe
Size 429KB
Sample240114-y9gemseac8
SHA256 d70e292a21ebc5ca1675ca585bcae52a51aad4bcee9bbbaf44b0a2cc635b64c7
MD5 b88444cf2c03ce4efe2a1608a379ee53
SHA1 68d9285ee72288656c258cf9db9c564226a48ddb
SHA512 7c9e116a417f2a15d2ca3f70b61697c9e34b6131b12221032cde9d64c41993f6f8cfa34196ed99122aa34d59159955d6362827f0d4eee1688bce465539e8d633
SSDEEP 12288:Zt5NpMGK6Ia5Jr4IQAvq3eSKXvVZhuwxHvh:Zt5NGGzIo3QSqOS+VZhT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kayflockmp4.exe

File Explorer

Kayflockmp4.exe

.exe 429KB

Kayflockmp4.exe

IMPHASH 1cbe23d5bc6daa93fa901ee43d967ea4
SHA256 d70e292a21ebc5ca1675ca585bcae52a51aad4bcee9bbbaf44b0a2cc635b64c7
MD5 b88444cf2c03ce4efe2a1608a379ee53
SHA1 68d9285ee72288656c258cf9db9c564226a48ddb
SHA512 7c9e116a417f2a15d2ca3f70b61697c9e34b6131b12221032cde9d64c41993f6f8cfa34196ed99122aa34d59159955d6362827f0d4eee1688bce465539e8d633
SSDEEP 12288:Zt5NpMGK6Ia5Jr4IQAvq3eSKXvVZhuwxHvh:Zt5NGGzIo3QSqOS+VZhT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FormatMessageA CreateFileA GetFileSizeEx WideCharToMultiByte IsDebuggerPresent WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA MultiByteToWideChar WaitForSingleObjectEx CloseHandle MoveFileExA Sleep InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GetTickCount UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx LocalFree SetLastError QueryPerformanceCounter VerifyVersionInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary GetSystemDirectoryA QueryPerformanceFrequency VerSetConditionMask SleepEx GetLastError DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection SetUnhandledExceptionFilter EnterCriticalSection

advapi32

CryptAcquireContextA CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptReleaseContext

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z

normaliz

IdnToAscii

ws2_32

getaddrinfo select __WSAFDIsSet WSAIoctl freeaddrinfo socket WSAStartup WSACleanup accept htonl closesocket recvfrom listen ioctlsocket setsockopt recv send WSAGetLastError bind gethostname connect ntohl sendto getpeername getsockname ntohs htons getsockopt WSASetLastError

wldap32

ord60 ord45 ord50 ord211 ord46 ord217 ord143 ord22 ord26 ord27 ord32 ord33 ord35 ord301 ord200 ord30 ord41 ord79

crypt32

CertFreeCertificateChainEngine CertGetNameStringA CertFreeCertificateChain CertCloseStore CertCreateCertificateChainEngine CryptQueryObject CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertGetCertificateChain CertOpenStore

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memcmp __current_exception __C_specific_handler __current_exception_context strstr __std_exception_destroy __std_exception_copy memcpy memset strchr strrchr memmove _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc realloc malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fclose _open _close _write _read fputs __p__commode _set_fmode fwrite __stdio_common_vsscanf feof fseek _lseeki64 ftell fgets __stdio_common_vsprintf fputc fflush __acrt_iob_func fread fopen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit __p___argc _exit exit _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv _cexit _set_app_type _seh_filter_exe terminate _register_thread_local_exe_atexit_callback __sys_nerr _getpid _beginthreadex _initterm_e _c_exit strerror _errno _invalid_parameter_noinfo_noreturn system _initterm

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strncpy strpbrk strspn isupper _strdup strcspn strcmp tolower strncmp

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access _stat64 _unlink _fstat64

api-ms-win-crt-convert-l1-1-0

strtol strtoul strtoll atoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr