TrixXPloit.rar
- SHA256 73b609e62a885cb34e16ae24652643374938b63fb909ff520ef3abab1acef8c6
Password
123
Overview
overview
10Static
static
3Launch_thi...e).bat
windows7-x64
10Launch_thi...e).bat
windows10-2004-x64
10License.exe
windows7-x64
10License.exe
windows10-2004-x64
10TrixXPloit.exe
windows7-x64
10TrixXPloit.exe
windows10-2004-x64
10autoexec.lnk
windows7-x64
3autoexec.lnk
windows10-2004-x64
3workspace.lnk
windows7-x64
3workspace.lnk
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launch_this(Not_exe file).bat
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launch_this(Not_exe file).bat
Resource
win10v2004-20240221-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
License.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
License.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
TrixXPloit.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral6
Sample
TrixXPloit.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
autoexec.lnk
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
autoexec.lnk
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
workspace.lnk
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
workspace.lnk
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target TrixXPloit.rar
- Size 2.2MB
- Sample240224-lsla2sha3y
- SHA256 73b609e62a885cb34e16ae24652643374938b63fb909ff520ef3abab1acef8c6
- MD5 1d520621071c6533e7e2b599eedddead
- SHA1 bb95da8d05c24bedc2c1fa2e4a50fa8ce522b907
- SHA512 8a3790af510e2bed0a91fd96009d537cee763f69bf856a785f5f3f4d6ff85435c7b6358ca5696612a06fa7742d5511df7440404f7b13ec387d27fed87ac28381
- SSDEEP 49152:2lE/1E8lo9tie8iGRna+4QWfaoforJPGD3insbFzo81M9GePPke:6s17OCPns58UMYe3d
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/License.exe
File Explorer
-
TrixXPloit.rar.rar 2.2MB
-
Launch_this(Not_exe file).bat39B
-
License.exe.exe 223KB
-
TrixXPloit.exe.exe 2.7MB
-
autoexec.lnk.lnk 1KB
-
theme.trixXPloit179B
-
workspace.lnk.lnk 1KB
Launch_this(Not_exe file).bat
- SHA256 9690649d6e693e18175ea4a29fb5860c9c17afcab518ad1e28b3365dc5fbe241
- MD5 5a2e0926fa37baca58359bee58abe0f7
- SHA1 f0a00abfd62e13c3db00a727d27a909a89fd6380
- SHA512 1d200f5d5edb872157c4e4e1ed574f4a13a58631f09c0dd085f702b460a0e541b52ab361d79a1711197a4b5ed5df70032340d84f0d969ee9f8d79cd09b1ffff5
- MD5 SHA1 SHA512
License.exe
- IMPHASH dcdd7fda4b828a13bab9a0dd63981aa0
- SHA256 22b3ba3c3572cab0bd553ac397e311e85bf64ac3aa1c7f315b3a5fe19d3cd3de
- MD5 c4a30082317aa701d555c0cb1a3345a8
- SHA1 cd36010d6bb2c282eae20edc14b25c61bb70e28d
- SHA512 002a050ed15c05d82cec7da4d889e25b4ed9f17355993709443f8af9ffd0a00bf2a034f2dd0c247a001ef7f1e91bee08e291f98768dcb6a89fe666562815524b
- SSDEEP 6144:pJfzvwSFMUOCsCnOIksBNQG2Nk8NeI/qt7:LfjwSFsCsC/B8pNSl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
18866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comdlg32
GetSaveFileNameA
GetOpenFileNameA
user32
GetDlgItemTextA
wsprintfA
MessageBoxA
LoadCursorA
GetClassInfoA
CheckDlgButton
SetWindowLongA
CallWindowProcA
GetActiveWindow
kernel32
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
VirtualProtect
VirtualAlloc
LoadLibraryA
GetProcAddress
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
HeapReAlloc
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
DecodePointer
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.QRyO3
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
main
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
TrixXPloit.exe
- IMPHASH 4b3ee95f35e7f4c0001cc18c48681f14
- SHA256 c880c4b1702d093d6e9bbeb772da0459da2387db9b7b13e95620996e5773db83
- MD5 115cd2af99e0164e38a30e31f4868f22
- SHA1 3bb156889b2c85eef03f601c53c9e3f639b776a9
- SHA512 9a609f90eeda49480873e4fab59b6edeaa0ee9c82569ee03d7cb69d968058201cdcaf490418b549b1d16332ed4db0a26fcd61a99c3296fbb3de4c76b10686151
- SSDEEP 49152:QX6ms1+CBy/+PK+ShRDw+I/SfZlNKfaBT0YA3jgpXSHXRVlCmb5BW:pmssgrPKJfF3wns6XRV8mbH
- MD5 SHA1 SHA512 SSDEEP
Password
123
PE Signature issue
Digest
5b:6f:ba:00:ee:0a:7d:7a:ac:49:af:c2:50:73:3b:37:bf:6e:23:e5:3b:d9:6b:0a:b1:1c:06:08:43:e7:46:7b
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 29, 2024
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
9f:0c:0f:42:e8:90:41:2b:92:30:d1:1d:66:a4:c8:6c:5d:44:d6:93
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 29, 2024
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
02:d6:aa:ea:b3:92:48:59:80:5e:bb:52:9e:31:4d:e0
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - May 2, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
02:d6:aa:ea:b3:92:48:59:80:5e:bb:52:9e:31:4d:e0
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - May 2, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strcat
strcpy
strlen
strncmp
strstr
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
autoexec.lnk
- SHA256 174a7720d2da06cdfcf29487d5659f55df46638ea28915f2ad69a44e21cb80f8
- MD5 0e66f35c879baed7836f38677e386185
- SHA1 0d67ea207b644d198cc5b864bf4d5329cfeb0335
- SHA512 2df4050e9e0e0d659034482c35b420ed78f2b785f01275a6de1d6bc27829ecbb93db295823e00b3a6369fec095e50ff87535583aa3048a09008e53364df4569b
- MD5 SHA1 SHA512
theme.trixXPloit
- SHA256 35ca3532a15b761495c6d3d404eb879038cbbabbeb7c0e289753a21483cd2465
- MD5 baa5d09a6df2078d9f4a5830ed5cb865
- SHA1 e2cbd8bd8357640d06ab7c97ef0db45f145308b1
- SHA512 acc9082161cddfb2807cbe563747b169e7777ae8a367dda6161423f3ccc24bef33ce2081ce9940cfab2a253c4f9c67776f795e8a404047160d33c470abe92f44
- MD5 SHA1 SHA512
workspace.lnk
- SHA256 5da88cf568b8124fd4708be9c6e436e1f8da9a394d40d075be55a91bb2a7f8b1
- MD5 2d616081fa0909450e50b608c97dee30
- SHA1 5ac9025a81f8a7c506dd100b7ae43d7b534ca28b
- SHA512 15cd58a26e3c9d2b97ffd074d2ff2a8948e2f003579a5032f1bb7aafe1501bcef8b9c126f29d1f9c4171ab9ff89030900980c6ad99f9f45d49f0c98bb66a6c22
- MD5 SHA1 SHA512