proext[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

proext.exe
Size

3.9MB
MD5

b8ff3fa3797f21498614239d583cb636
SHA1

23fa79658831b5f4714bde8f39b4dfef1dc25351
SHA256

2d6916b87384d03a05d41e3a81e4aacb250d59b0333c4b3605a35b7ec58ecf57
SHA512

1831021746de038b37334c29ff35a79c3501d3d67893240eaa84833ecc66712754706fde2539cbb3a3c028dca62439dbc7799dec7eef085a65eaad89dc0e2497
SSDEEP

49152:jfLhJ9gW/ti8EeLn+CrsEGm1PEox7HnGe6lWnRD4kf00E2aNnuInZIU6ieHE3/A:jfLjp+2sX5G6Ab0e+mE3/A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
proext.exe

Files

proext.exe
.exe windows:6 windows x64 arch:x64

f50fc0e50d83bd584dc0212a2168e0e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\ProExt\ProExt\build\x86_64-pc-windows-msvc\release\deps\proext.pdb

Imports

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

opengl32

wglCreateContext
wglMakeCurrent
wglDeleteContext
wglShareLists
wglGetProcAddress
wglGetCurrentDC
wglGetCurrentContext

kernel32

LoadLibraryW
GetProcAddress
RtlVirtualUnwind
GetLastError
CreateFileW
WriteFile
ReadFile
GetOverlappedResult
WaitForSingleObject
CreateNamedPipeW
CreateEventW
CancelIoEx
LoadLibraryA
SetNamedPipeHandleState
GetModuleHandleW
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadErrorMode
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
Module32NextW
VirtualQueryEx
ReadProcessMemory
OpenProcess
Process32NextW
CreateToolhelp32Snapshot
TryAcquireSRWLockExclusive
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AcquireSRWLockExclusive
Sleep
GetModuleHandleA
ReleaseSRWLockExclusive
WaitNamedPipeW
lstrlenW
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
LoadLibraryExA
GetSystemTimeAsFileTime
CreateThread
FormatMessageW
WriteConsoleW
MultiByteToWideChar
FreeEnvironmentStringsW
ReleaseMutex
FindClose
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
UpdateProcThreadAttribute
DuplicateHandle
SetFilePointerEx
InitializeProcThreadAttributeList
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFullPathNameW
ExitProcess
GetConsoleMode
GetStdHandle
GetCurrentProcessId
SetHandleInformation
WriteFileEx
SleepEx
ReadFileEx
TerminateProcess
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
IsProcessorFeaturePresent

user32

MessageBoxW
InvalidateRgn
SetWindowPos
FindWindowW
IsWindow
GetClientRect
ClientToScreen
SetWindowDisplayAffinity
GetForegroundWindow
SetWindowPlacement
GetWindowPlacement
GetWindowLongPtrW
RegisterClassExW
CreateWindowExW
PeekMessageW
PostThreadMessageW
SetClassLongPtrW
ChangeDisplaySettingsExW
SendInput
DispatchMessageW
DefWindowProcW
TranslateMessage
DestroyIcon
GetCursorPos
SystemParametersInfoA
SetForegroundWindow
GetMessageW
MapVirtualKeyA
GetRawInputData
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
RedrawWindow
SetWindowLongPtrW
GetWindowRect
ShowCursor
ClipCursor
GetClipCursor
GetSystemMetrics
AdjustWindowRectEx
GetMenu
GetActiveWindow
ShowWindow
SetWindowLongW
SendMessageW
IsProcessDPIAware
ReleaseCapture
SetCapture
RegisterTouchWindow
MsgWaitForMultipleObjectsEx
PostMessageW
RegisterRawInputDevices
DestroyWindow
RegisterWindowMessageA
GetClassInfoExW
GetClassNameW
CallNextHookEx
SetWindowsHookExW
MapVirtualKeyW
GetKeyState
GetDC
SetCursorPos
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
CloseTouchInputHandle
GetTouchInputInfo
TrackMouseEvent
SetCursor
LoadCursorW
ScreenToClient
GetWindowLongW
GetUpdateRect
ValidateRect

gdi32

CreateRectRgn
DescribePixelFormat
GetPixelFormat
GetDeviceCaps
ChoosePixelFormat
SwapBuffers
SetPixelFormat
DeleteObject

ole32

OleInitialize
RevokeDragDrop
CoCreateInstance
CoInitializeEx
RegisterDragDrop
CoUninitialize
CoTaskMemFree

dwmapi

DwmEnableBlurBehindWindow

ws2_32

getpeername
getaddrinfo
WSASocketW
getsockname
listen
bind
WSAStartup
WSACleanup
freeaddrinfo
closesocket
WSAGetLastError
setsockopt
getsockopt
recv
WSARecv
WSASend
send
accept
select
connect
ioctlsocket
WSADuplicateSocketW

winmm

timeEndPeriod
timeBeginPeriod
timeGetDevCaps

shell32

SHGetKnownFolderPath
DragFinish
DragQueryFileW

imm32

ImmReleaseContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext

uxtheme

SetWindowTheme

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

ntdll

RtlNtStatusToDosError
NtWriteFile
NtReadFile

vcruntime140

__current_exception_context
memcpy
__current_exception
__C_specific_handler
__CxxFrameHandler3
memcmp
memset
memmove
strstr
memchr
_CxxThrowException

api-ms-win-crt-math-l1-1-0

fmodf
__setusermatherr
acosf
floorf
log
ceilf
logf
atan2f
sinf
powf
truncf
atanf
sqrtf
floor
trunc
round
pow
cosf
tanf

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
strlen
strcmp

api-ms-win-crt-runtime-l1-1-0

_exit
exit
__p___argv
_initterm
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_register_onexit_function
_crt_atexit
terminate
__p___argc
_initterm_e
_wassert

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
fread
__p__commode
ftell
fflush
_set_fmode
fseek
fwrite
fclose
__stdio_common_vfprintf
__stdio_common_vsprintf
__acrt_iob_func
fopen

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f50fc0e50d83bd584dc0212a2168e0e7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

advapi32

opengl32

kernel32

user32

gdi32

ole32

dwmapi

ws2_32

winmm

shell32

imm32

uxtheme

oleaut32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 3KB - Virtual size: 49KB

.pdata Size: 107KB - Virtual size: 107KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 3KB - Virtual size: 49KB

.pdata
Size: 107KB - Virtual size: 107KB

.reloc
Size: 12KB - Virtual size: 12KB