1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1.exe
Size

377KB
MD5

13b4978f402ba2262421b08d1a6d404d
SHA1

90332a33d2e42bedf91c1a6e1ccda2a26fad2c32
SHA256

5ebaec06e9a21b9bd83b2251c46c51c179f5268aa347d5ccb6322b3ed0c680ca
SHA512

bca3191367961186131052f8f7c4ab0e909ef54de181fffd50f9912bb32891af90fb8f752d520d301eaf0be0686e59cd023801e5e1c84ab01957ce21455eb6d6
SSDEEP

6144:VPQmQ7/rJ6KB94yfxV+SINca1yzyeHUJgQkOYBuvsqqDL6++4RTK0nb7EMJ95Rr3:VPQmQfcKB94UVAFdkruvpqn6XKJMY9r3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1.exe

Files

1.exe
.exe windows:5 windows x86 arch:x86

68466e4e705a538432297cbb7579a0b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
ioctlsocket
htons
__WSAFDIsSet
accept
WSAIoctl
getpeername
connect
WSAStartup
inet_ntoa
inet_addr
socket
htonl
send
select
recvfrom
WSAGetLastError
listen
gethostbyname
closesocket
bind
setsockopt
shutdown
getsockname

winmm

timeGetTime

shlwapi

StrToIntW
PathUnquoteSpacesW
PathFileExistsW
StrChrA
StrCmpNA
StrStrIW
PathRemoveFileSpecW
StrCmpNIA
StrCmpNIW
PathSkipRootW
PathCombineW
StrToIntA
PathMatchSpecW

dbghelp

MiniDumpWriteDump
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shell32

SHGetSpecialFolderPathA
ExtractIconExW
SHGetFolderPathA
CommandLineToArgvW
SHGetFolderPathW
Shell_NotifyIconW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderLocation

kernel32

GetComputerNameA
GetTickCount
GlobalFree
GetTimeZoneInformation
CreateFileW
ExitProcess
CreateProcessW
GetSystemDirectoryA
lstrcatA
FindFirstFileA
ReleaseMutex
Sleep
MoveFileW
GetCurrentThreadId
lstrcmpA
CreateMutexW
FindFirstChangeNotificationW
SetUnhandledExceptionFilter
FindCloseChangeNotification
GetCurrentThread
GetModuleFileNameW
lstrlenW
GetLocalTime
FindNextChangeNotification
GetCurrentProcessId
GetCommandLineW
SetPriorityClass
SetErrorMode
OpenMutexW
GetLastError
ResetEvent
GlobalUnlock
GlobalAlloc
CreateEventW
lstrcmpiW
UnmapViewOfFile
CreateDirectoryA
MapViewOfFile
GlobalLock
FileTimeToSystemTime
GetFileSize
GetNativeSystemInfo
GetLogicalDriveStringsA
CreateFileMappingW
FindClose
GetModuleHandleW
lstrlenA
VirtualFree
FindFirstFileW
GetDriveTypeA
OpenProcess
QueryPerformanceCounter
GetExitCodeProcess
CreateProcessA
TerminateProcess
LocalFileTimeToFileTime
GetSystemTime
SetFileAttributesW
GetHandleInformation
SetLastError
DeleteFileW
GetProcAddress
VirtualAlloc
GetFileInformationByHandle
DeleteFileA
FreeLibrary
lstrcatW
MoveFileA
Process32FirstW
OpenThread
lstrcpyW
lstrcmpiA
FlushFileBuffers
GlobalMemoryStatusEx
GetEnvironmentVariableA
GetFileAttributesW
FileTimeToLocalFileTime
GetSystemInfo
GetSystemDirectoryW
DosDateTimeToFileTime
Process32NextW
WTSGetActiveConsoleSessionId
GetModuleHandleA
OpenFileMappingW
VirtualProtect
CreateToolhelp32Snapshot
FileTimeToDosDateTime
SetEndOfFile
CloseHandle
CreateThread
HeapValidate
GetProcessHeaps
HeapSetInformation
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
lstrcpyA
SetEvent
WaitForSingleObject
lstrcpynA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
IsBadReadPtr
LocalFree
GetCurrentProcess
GetLocaleInfoW
GetWindowsDirectoryA
GetVersionExW
VirtualFreeEx
ReadProcessMemory
CreateFileA
VirtualAllocEx
lstrcpynW
ConnectNamedPipe
CreateNamedPipeW
ReadFile
DisconnectNamedPipe
CreateDirectoryW
RemoveDirectoryW
GetTimeFormatW
CreateRemoteThread
TerminateThread
FlushInstructionCache
Module32FirstW
OpenEventW
WaitForMultipleObjects
Module32NextW
WriteProcessMemory
SwitchToThread
WideCharToMultiByte
MultiByteToWideChar
ProcessIdToSessionId
GetSystemWow64DirectoryW
SetThreadExecutionState
WriteFile
SetFilePointer
GetDateFormatW
IsBadWritePtr
FindNextFileW
ExpandEnvironmentStringsW
GetTempFileNameW
GetFileAttributesA
GetTempPathW
GetTempFileNameA
GetTempPathA
EnumResourceNamesW
FreeResource
FindResourceW
VerLanguageNameW
LoadResource
LoadLibraryExW
EndUpdateResourceW
SetFileTime
SizeofResource
BeginUpdateResourceW
LockResource
UpdateResourceW
GetFileTime
RtlUnwind

ntdll

memcpy
isspace
ZwWriteFile
ZwReadFile
RtlCreateUserThread
ZwResumeThread
_CIpow
ZwQueryInformationProcess
memset
ZwQueryInformationThread
ZwCreateSection
ZwOpenProcess
ZwUnmapViewOfSection
ZwQuerySystemInformation
ZwMapViewOfSection
NtQueryVirtualMemory
ZwQueryInformationFile
_aulldvrm
tolower
_allmul
RtlImageNtHeader
_chkstk

advapi32

ConvertSidToStringSidW
RegNotifyChangeKeyValue
EncryptFileW
RegCreateKeyW
RegSetValueW
RegQueryInfoKeyW
RegQueryValueW
RegSetValueExW
RegCloseKey
RegDeleteValueW
AdjustTokenPrivileges
RegOpenKeyW
RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
GetSecurityDescriptorSacl
RevertToSelf
SetSecurityInfo
SetKernelObjectSecurity
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessAsUserW
GetTokenInformation
RegQueryValueExW
OpenProcessToken
RegEnumKeyW
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegFlushKey
RegOpenKeyExW

user32

MoveWindow
DispatchMessageW
SetCursor
SendMessageA
PeekMessageW
PostThreadMessageW
GetWindowTextA
DestroyCaret
GetPropW
MapWindowPoints
IsWindowVisible
SetThreadDesktop
SendMessageTimeoutW
ShowWindow
SetWindowPos
EndDialog
SetWindowLongW
GetAncestor
GetWindowLongW
BringWindowToTop
GetGUIThreadInfo
GetClassLongW
SetFocus
WindowFromPoint
GetWindowInfo
AttachThreadInput
GetParent
SetForegroundWindow
DialogBoxIndirectParamW
GetLastActivePopup
KillTimer
PostMessageW
IsIconic
RealChildWindowFromPoint
SetTimer
GetClassNameA
ReleaseCapture
CreateIconIndirect
CheckMenuRadioItem
DefWindowProcW
GetKeyboardLayoutList
CheckMenuItem
SetClipboardViewer
RegisterClassW
GetSystemMetrics
OpenClipboard
CreateWindowExW
GetUserObjectInformationA
GetCursorPos
GetThreadDesktop
ChangeClipboardChain
ReleaseDC
TranslateMessage
GetIconInfo
GetDesktopWindow
GetUserObjectInformationW
GetWindowDC
CloseDesktop
LoadCursorW
CreateDesktopA
FindWindowW
IsClipboardFormatAvailable
GetClassNameW
GetMessageW
CloseClipboard
DestroyWindow
IsRectEmpty
GetDoubleClickTime
GetWindowRect
ScreenToClient
GetWindowRgn
DestroyIcon
SetWindowTextW
SetLayeredWindowAttributes
IsWindow
FindWindowExW
GetWindowThreadProcessId
GetWindow
RegisterWindowMessageA
DrawTextW
GetPropA
DrawIcon
GetDC
CharUpperA
OpenInputDesktop
EnumWindowStationsW
RedrawWindow
FrameRect
OpenWindowStationW
FillRect
GetShellWindow
mouse_event
SetClipboardData
SetProcessWindowStation
CloseWindowStation
EmptyClipboard
SystemParametersInfoW
GetClipboardData
GetForegroundWindow
GetProcessWindowStation
GetLastInputInfo
SendInput
ToUnicodeEx
MapVirtualKeyExW
GetAsyncKeyState
GetKeyboardLayout
GetKeyState
MapVirtualKeyW
VkKeyScanExW
keybd_event
wsprintfA
EnumDisplayMonitors
wsprintfW
GetDlgItem
SetClassLongW
LoadIconW
GetClientRect
CharToOemA
GetWindowTextLengthW
CallWindowProcW
DestroyMenu
SendMessageW
DrawEdge
CreatePopupMenu
AppendMenuW
GetScrollBarInfo
TrackPopupMenu
SetPropA
PrintWindow
GetDCEx

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

NetUserEnum
NetUserGetInfo
NetApiBufferFree

winscard

SCardFreeMemory
SCardEstablishContext
SCardConnectW
SCardListReadersW
SCardReleaseContext
SCardDisconnect

gdi32

CreateFontIndirectW
DeleteObject
SelectObject
CreateFontW
SetBkColor
DeleteDC
CreatePatternBrush
CreateSolidBrush
SelectClipRgn
OffsetRgn
CreateCompatibleBitmap
SaveDC
CreateRectRgn
RestoreDC
CreateCompatibleDC
SetBkMode
GdiFlush
GetDIBits
GetDeviceCaps
GetObjectW
SetDIBitsToDevice
BitBlt
GetStockObject
CreateDIBSection
SetTextColor
CreateBitmap

psapi

GetModuleFileNameExW

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

comctl32

ord17

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 366B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.8c9051
Size: 68KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68466e4e705a538432297cbb7579a0b7

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winmm

shlwapi

dbghelp

version

shell32

kernel32

ntdll

advapi32

user32

ole32

userenv

netapi32

winscard

gdi32

psapi

crypt32

comctl32

wtsapi32

Sections

.text Size: 237KB - Virtual size: 237KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 5KB - Virtual size: 15KB

.rsrc Size: 366B - Virtual size: 368B

.reloc Size: 7KB - Virtual size: 9KB

.8c9051 Size: 68KB - Virtual size: 72KB

.text
Size: 237KB - Virtual size: 237KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 5KB - Virtual size: 15KB

.rsrc
Size: 366B - Virtual size: 368B

.reloc
Size: 7KB - Virtual size: 9KB

.8c9051
Size: 68KB - Virtual size: 72KB