m | Triage

Resubmissions

18/01/2024, 22:41

240118-2mhwqscbfm 3

18/01/2024, 22:33

240118-2gjabacch5 3

Sharing

Copy URL

Twitter E-mail

General

Target

m
Size

12.0MB
MD5

2d8837ccf56a90aaae8a05bfcf178225
SHA1

e975447292e05dc17acef6b8337edadd4f94153f
SHA256

8275c854aa44f9ca4c07adf841e0e2e924688756d1002265fc7deae93c6696f0
SHA512

c4b654c58f921333376b58527bac4499acdc8106fc0419a9d186054143ebd3e186fb866d1271aef2f65fc013f72abbd67a71484604a668acecc330c4bb71f9e5
SSDEEP

98304:7h+BtCIsU2T2MF93eNKHX62BHG2xV/KasL6jsT0NNPd7qBnRtLiAUemKU6:1D2MFkNKHnB3i7LE00fPaRtLiAUeE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
m

Files

m
.exe windows:6 windows x64 arch:x64

314885973ac2cfa88c0ad7a40e4c4850

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
CreatePipe
GetQueuedCompletionStatus
PeekNamedPipe
CreateMutexA
GetModuleHandleA
PostQueuedCompletionStatus
CreateEventW
GetTickCount64
GetCurrentProcess
SetEvent
TerminateThread
QueueUserAPC
CreateWaitableTimerA
GetComputerNameW
SleepEx
CreateProcessA
CreateIoCompletionPort
IsWow64Process
SetLastError
SetWaitableTimer
SetHandleInformation
GetModuleFileNameA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
WaitForMultipleObjects
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcmpiW
OpenMutexA
GetLastError
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
ResumeThread
ExitThread
RtlUnwind
RtlUnwindEx
GetProcessAffinityMask
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetCurrentProcessorNumberEx
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
GetFileInformationByHandle
GetFileTime
RemoveDirectoryW
SetFilePointerEx
DeviceIoControl
GetModuleHandleW
CreateDirectoryExW
CopyFileExW
MoveFileExW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetSystemDirectoryA
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetStdHandle
GetFileType
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
RtlVirtualUnwind
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryW
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetExitCodeProcess
GetFileAttributesExA
FindFirstFileExA
FindNextFileA
GetModuleFileNameW
GetModuleHandleExA
ResetEvent
CreateEventA
LoadLibraryExA
LocalAlloc
RtlPcToFileHeader
RaiseException
GetLocaleInfoEx
GetStringTypeW
TryAcquireSRWLockExclusive
SwitchToThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
LCMapStringEx
SleepConditionVariableCS
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

SetWindowLongPtrA
GetWindowTextW
ReleaseDC
GetDesktopWindow
TranslateMessage
GetForegroundWindow
EnumDisplaySettingsA
GetMonitorInfoA
SetWindowsHookExA
GetActiveWindow
GetSystemMetrics
CallNextHookEx
MonitorFromWindow
MessageBoxW
GetDC
GetLastInputInfo
DispatchMessageA
GetMessageA
MonitorFromRect
MonitorFromPoint
LoadIconA
LoadCursorA
GetClassLongPtrA
ReleaseCapture
GetWindowLongPtrA
GetWindowLongA
GetProcessWindowStation
GetUserObjectInformationW
PeekMessageA
SendMessageA
DefWindowProcA
CallWindowProcA
RegisterClassA
UnregisterClassA
CreateWindowExA
ShowWindow
MoveWindow
SetWindowPos
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
SetFocus
GetKeyState
SetCapture
OffsetRect
BeginPaint
EndPaint
InvalidateRect
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
SetCursor
ClientToScreen
ScreenToClient
SubtractRect

gdi32

DeleteDC
GetDIBits
CreateCompatibleDC
SelectObject
SetStretchBltMode
DeleteObject
CreateCompatibleBitmap
StretchBlt
GdiFlush
GetObjectA
SetDIBColorTable
CreateDIBSection
GetStockObject
GetCurrentObject
FillRgn
CreateRectRgn
BitBlt
CombineRgn

advapi32

CryptSetHashParam
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
ReportEventW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
GetUserNameA
RegCloseKey
CryptGetUserKey
CryptGetProvParam
RegSetValueExA
CryptDestroyKey
CryptAcquireContextW
CryptEnumProvidersA

shell32

SHGetKnownFolderPath
ord680
ShellExecuteA

ole32

CoCreateInstance
CoInitialize
StgCreateDocfile
PropVariantClear
CoTaskMemFree
CoUninitialize

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension

ws2_32

WSASocketW
WSASetLastError
listen
ntohl
select
WSASend
closesocket
WSAIoctl
getaddrinfo
WSAStartup
getpeername
getsockname
ntohs
connect
WSAAddressToStringW
WSARecv
getsockopt
htonl
htons
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
gethostname
sendto
WSAWaitForMultipleEvents
inet_ntop
inet_pton
WSAResetEvent
bind
accept
__WSAFDIsSet
WSACleanup
gethostbyname
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
recv
send
socket
shutdown
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
recvfrom
WSAEventSelect

bcrypt

BCryptGenRandom

mfplat

MFCreateMediaType
MFFrameRateToAverageTimePerFrame
MFCreateMemoryBuffer
MFStartup
MFCreateAttributes
MFCreateSample

mf

MFEnumDeviceSources
MFCreateDeviceSource

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL
MFCreateSourceReaderFromURL

dxgi

CreateDXGIFactory

d3d11

D3D11CreateDevice

shlwapi

ord219

comdlg32

GetSaveFileNameA

oleaut32

VariantInit
OleCreatePropertyFrame
VariantClear

Exports

Exports

cJSONUtils_AddPatchToArray
cJSONUtils_ApplyPatches
cJSONUtils_ApplyPatchesCaseSensitive
cJSONUtils_FindPointerFromObjectTo
cJSONUtils_GenerateMergePatch
cJSONUtils_GenerateMergePatchCaseSensitive
cJSONUtils_GeneratePatches
cJSONUtils_GeneratePatchesCaseSensitive
cJSONUtils_GetPointer
cJSONUtils_GetPointerCaseSensitive
cJSONUtils_MergePatch
cJSONUtils_MergePatchCaseSensitive
cJSONUtils_SortObject
cJSONUtils_SortObjectCaseSensitive
cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

314885973ac2cfa88c0ad7a40e4c4850

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

crypt32

ws2_32

bcrypt

mfplat

mf

mfreadwrite

dxgi

d3d11

shlwapi

comdlg32

oleaut32

Exports

Exports

Sections

.text Size: 8.7MB - Virtual size: 8.7MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 130KB - Virtual size: 294KB

.pdata Size: 325KB - Virtual size: 325KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 8.7MB - Virtual size: 8.7MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 130KB - Virtual size: 294KB

.pdata
Size: 325KB - Virtual size: 325KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 65KB