1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.exe
Size 3.3MB
Sample240222-mx6yzsga5x
SHA256 0551101a6be6b0432f965d6a070871759ae79c1feacfc04d382a632a4566d35d
MD5 9e5b3430d333c7c0a49fbb228c7fbd3a
SHA1 64b5657d9c06ae11fddbedb35e1bdda133436016
SHA512 2b3cf583522ac7e062d1fe06aab63c5409e6d4dfce138893f10de9742bec06fd8d4f212de73d2eefddbb34f4083ed4b5526f4472f55fcb8cbc8147f93356a76f
SSDEEP 49152:0CXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4J:0CxRXOhEc2MgJHTp+isLw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

dave

Malware Config

Signatures

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

resource	yara_rule
sample	dave

File Explorer

1.exe

.exe 3.3MB

1.exe

IMPHASH 5e4731b579fcbf2ee2d5b665a7fef172
SHA256 0551101a6be6b0432f965d6a070871759ae79c1feacfc04d382a632a4566d35d
MD5 9e5b3430d333c7c0a49fbb228c7fbd3a
SHA1 64b5657d9c06ae11fddbedb35e1bdda133436016
SHA512 2b3cf583522ac7e062d1fe06aab63c5409e6d4dfce138893f10de9742bec06fd8d4f212de73d2eefddbb34f4083ed4b5526f4472f55fcb8cbc8147f93356a76f
SSDEEP 49152:0CXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4J:0CxRXOhEc2MgJHTp+isLw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Dave packer

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

PE Signature issue

Digest

b6:0b:32:33:94:6d:d1:eb:98:4d:57:bf:bd:ea:a9:04:94:3e:08:ab:58:f5:17:3d:c6:5d:40:e4:e5:35:b5:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=51 770 075,CN=A.P.Hernandez Consulting s.r.o.,O=A.P.Hernandez Consulting s.r.o.,L=Sered,ST=Trnava Region,C=SK,1.3.6.1.4.1.311.60.2.1.3=#1302534b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 22, 2024

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

29:41:d5:f8:75:85:01:f9:db:c4:ba:15:80:58:c3:b5

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2024 - Jan 24, 2025

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

652194

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\work\msi\Git\MxMSI_Master\_MsiBuildSystem\bin\SfxMaker\stub_Release_Win32_v120_xp.pdb

kernel32

LoadLibraryExW GlobalDeleteAtom lstrcmpA lstrcmpW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GlobalAddAtomW LoadLibraryA EncodePointer GlobalFindAtomW GetFileSizeEx GetFileTime SystemTimeToFileTime GetFullPathNameW GetVolumeInformationW LockFile UnlockFile DuplicateHandle GetStringTypeExW GetThreadLocale GlobalFlags CompareStringW GetSystemDefaultUILanguage SetErrorMode GetUserDefaultLCID RtlUnwind CreateThread ExitThread GetCPInfo GetSystemTimeAsFileTime ExitProcess GetModuleHandleExW AreFileApisANSI IsDebuggerPresent IsProcessorFeaturePresent SetStdHandle GetFileType HeapQueryInformation GetSystemInfo VirtualProtect VirtualQuery GetStartupInfoW GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter GetCurrentThread TerminateProcess IsValidCodePage GetOEMCP GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW OutputDebugStringW GetDateFormatW GetTimeFormatW LCMapStringW IsValidLocale EnumSystemLocalesW WriteConsoleW SetEnvironmentVariableA FreeResource LocalReAlloc LocalAlloc GlobalHandle EnterCriticalSection GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LocalFree GlobalFree GlobalUnlock GlobalLock GlobalAlloc OutputDebugStringA GetACP MulDiv GetVersion FindResourceExW lstrlenA CreateProcessW GetEnvironmentVariableW LoadLibraryW FreeLibrary EnumResourceNamesW SetFilePointerEx FlushFileBuffers ResumeThread SuspendThread GetThreadPriority SetThreadPriority GetDriveTypeW GetCommandLineW FormatMessageW GetLongPathNameW InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap LCMapStringA GetStringTypeExA FormatMessageA WaitForSingleObjectEx CreateEventA CreateSemaphoreA WaitForMultipleObjectsEx OpenEventA SetWaitableTimer CreateWaitableTimerA CreateTimerQueue SignalObjectAndWait SwitchToThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread InitializeSListHead InterlockedPopEntrySList HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer Sleep GetExitCodeProcess GetDiskFreeSpaceExW MapViewOfFileEx GetFileAttributesExW GetFileAttributesW GetModuleFileNameW CreateFileMappingW UnmapViewOfFile GetCurrentProcess GetUserDefaultLangID GetUserDefaultUILanguage GetLocaleInfoW FindResourceW SizeofResource LoadResource LockResource WaitForMultipleObjects GetStdHandle GetFileInformationByHandle InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize FindNextFileW FindFirstFileW GetModuleHandleA GetLogicalDriveStringsW FindClose MoveFileW DeleteFileW SetFileAttributesW CreateFileW RemoveDirectoryW CreateDirectoryW GetCurrentDirectoryW GetTempPathW GetSystemDirectoryW GetModuleHandleW SetFileTime SetLastError GetProcAddress FileTimeToLocalFileTime CreateSemaphoreW CreateEventW CloseHandle WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection GetLastError GetVersionExW VirtualFree VirtualAlloc FileTimeToSystemTime WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter

user32

IntersectRect GetSysColorBrush DestroyMenu SetWindowTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetClassLongW SetWindowLongW EqualRect AdjustWindowRectEx RemovePropW GetPropW SetPropW SetForegroundWindow UpdateWindow SetMenu GetMenu GetCapture GetDlgCtrlID GetClassInfoExW GetClassInfoW CallWindowProcW DefWindowProcW GetMessageTime RealChildWindowFromPoint GetWindowTextLengthW SetFocus IsDialogMessageW GetTopWindow MessageBeep IsChild SetWindowContextHelpId WindowFromPoint GetLastActivePopup MessageBoxW PostQuitMessage LoadStringA CallNextHookEx SetWindowsHookExW ValidateRect DispatchMessageW TranslateMessage GetMessageW GetDesktopWindow SetActiveWindow IsWindowEnabled GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW DestroyWindow LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem ClientToScreen EndPaint BeginPaint GetWindowDC CharNextW OffsetRect SetCapture ReleaseCapture CopyAcceleratorTableW InvalidateRgn SetRect RegisterClipboardFormatW PostThreadMessageW TabbedTextOutW GrayStringW DrawTextExW DrawTextW UnhookWindowsHookEx GetMessagePos GetMenuItemCount GetMenuItemID GetSubMenu SendDlgItemMessageA PtInRect IsRectEmpty DrawFrameControl ShowCaret HideCaret GetCursorPos SetCursor GetWindow GetParent GetWindowLongW MapWindowPoints GetWindowTextW GetForegroundWindow FlashWindowEx CreateWindowExW FillRect GetSysColor SystemParametersInfoW InvalidateRect DeleteMenu GetSystemMenu KillTimer SetTimer GetKeyState SetDlgItemTextW InflateRect CopyRect RedrawWindow GetFocus TrackMouseEvent ScreenToClient GetClientRect GetDlgItem EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos IsWindow AllowSetForegroundWindow GetWindowThreadProcessId GetClassNameW MsgWaitForMultipleObjects PeekMessageW IsWindowVisible UnregisterClassW MapDialogRect LoadIconW LoadCursorW GetWindowRect ReleaseDC GetDC DefDlgProcW RegisterClassW ReplyMessage RegisterWindowMessageW LoadImageW GetSystemMetrics PostMessageW SendMessageW EnableWindow DestroyIcon CharUpperW GetNextDlgGroupItem LoadStringW

gdi32

SetWindowExtEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetBkColor SetViewportExtEx GetRgnBox SetMapMode ExtTextOutW TextOutW SetTextColor GetTextColor SetBkColor ExtSelectClipRgn SaveDC RestoreDC RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetStockObject GetClipBox ExcludeClipRect Escape DeleteDC CreateBitmap OffsetViewportOrgEx SetViewportOrgEx DeleteObject CreateFontIndirectW GetDeviceCaps GetObjectW SelectObject CreateSolidBrush

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegDeleteValueW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHOpenFolderAndSelectItems SHParseDisplayName SHGetSpecialFolderPathW SHCreateItemFromParsingName ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW ord165 ShellExecuteW

comctl32

ord413 ord410 InitCommonControlsEx ord412

shlwapi

UrlCreateFromPathW PathCreateFromUrlAlloc UrlIsW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW

ole32

CreateILockBytesOnHGlobal CoFreeUnusedLibraries StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromProgID CLSIDFromString CoCreateGuid CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize StgOpenStorageOnILockBytes OleInitialize OleUninitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter

oleaut32

OleCreateFontIndirect SysFreeString SysAllocString SysAllocStringLen VariantClear VariantCopy VariantInit VariantChangeType SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy

oledlg

OleUIBusyW

msi

ord118 ord48 ord92 ord171 ord160 ord159 ord8 ord32

oleacc

CreateStdAccessibleObject LresultFromObject

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

274KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1.exe

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

msi

oleacc

generic