controller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

controller.exe
Size

3.3MB
MD5

489e8441824de030a3cd3c57264496fa
SHA1

75dd85d2c368cf237a04bc37f260bba30ebf2970
SHA256

d32d0aa365a36331e4454517f0bb4715e7cb9f1683c647972369988fd8306619
SHA512

8ee3c011d734f261a0780fcb322ea39f8c9f4c658877062ec032007d1622abfa84d8ec758d2cb1bc5d49a7e4d4d2c049a2618c1fffa95388131d99190fac1c99
SSDEEP

49152:HAphCaQkGlNZzT2twP0DI0KeiWOvCIWhAZHJxN6vhQIUwn62w/vPtgn:kaHPXPgIGU2Apehn62wf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
controller.exe

Files

controller.exe
.exe windows:6 windows x64 arch:x64

c884bffaccfe2cb26ddd238ff977fa71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlUnwindEx
RtlPcToFileHeader
NtReadFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlNtStatusToDosError
NtWriteFile
RtlGetVersion

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
QueryPerformanceCounter
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileSizeEx
ReadConsoleW
GetConsoleOutputCP
GetLastError
FlushFileBuffers
GetCurrentThreadId
CloseHandle
LCMapStringW
CompareStringW
HeapReAlloc
GetConsoleProcessList
FlsFree
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCommandLineW
GetStdHandle
FlsSetValue
FlsGetValue
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeviceIoControl
FlsAlloc
CreateFileA
SwitchToThread
GetConsoleMode
GetFileType
HeapSize
OutputDebugStringW
GetCommandLineA
HeapFree
WriteFile
ReadFile
GetModuleHandleExW
TlsFree
TlsSetValue
SetEndOfFile
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
FreeLibrary
DeleteCriticalSection
GlobalLock
GlobalSize
WideCharToMultiByte
GlobalUnlock
LeaveCriticalSection
MultiByteToWideChar
GlobalAlloc
EnterCriticalSection
RaiseException
GlobalFree
EncodePointer
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
CreateThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameW
CreateFileW
SetThreadErrorMode
LoadLibraryExW
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetEnvironmentVariableW
ReleaseMutex
SetFileInformationByHandle
GetFileInformationByHandle
GetStringTypeW
GetFullPathNameW
CreateMutexA
SetFilePointerEx
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleMode
ReleaseSRWLockShared
AcquireSRWLockShared
GetFileInformationByHandleEx
WaitForSingleObject
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
ExitProcess
FindClose
Sleep
GetModuleHandleA
GetCurrentThread
TryAcquireSRWLockExclusive
GetCurrentProcessId
WriteConsoleW
SetLastError
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
FindFirstFileW

user32

SendInput
SystemParametersInfoA
PostMessageW
RegisterTouchWindow
DestroyIcon
SendMessageW
SetWindowLongW
GetWindowLongW
GetMenu
AdjustWindowRectEx
GetActiveWindow
GetClipCursor
ClipCursor
ShowCursor
SetForegroundWindow
IsProcessDPIAware
GetKeyboardLayout
ToUnicodeEx
GetKeyState
GetSystemMetrics
GetMessageW
MapVirtualKeyW
ChangeDisplaySettingsExW
GetUpdateRect
ValidateRect
GetRawInputData
TranslateMessage
RegisterWindowMessageA
DispatchMessageW
GetKeyboardState
GetClientRect
MsgWaitForMultipleObjectsEx
GetCursorPos
PeekMessageW
PostThreadMessageW
SetWindowLongA
RegisterRawInputDevices
CreateWindowExW
RegisterClassExW
FindWindowW
GetWindowRect
GetWindowThreadProcessId
FindWindowExA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
CloseTouchInputHandle
GetTouchInputInfo
DefWindowProcW
MapVirtualKeyA
ReleaseCapture
SetCapture
TrackMouseEvent
SetWindowLongPtrW
GetWindowPlacement
OpenClipboard
DestroyWindow
GetDC
MessageBoxA
RedrawWindow
GetWindowLongPtrW
InvalidateRgn
SetWindowPos
ShowWindow
SetCursor
LoadCursorW
SetCursorPos
SetWindowDisplayAffinity
SendMessageA
MoveWindow
GetFocus
ClientToScreen
SetActiveWindow
SetWindowLongPtrA
GetWindowLongPtrA
GetAsyncKeyState
ScreenToClient
SetWindowPlacement

shell32

DragQueryFileW
DragFinish
IsUserAnAdmin

ole32

RegisterDragDrop
RevokeDragDrop
CoUninitialize
CoInitializeEx
CoCreateInstance
OleInitialize

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

winmm

timeEndPeriod
timeGetDevCaps
timeBeginPeriod

oleaut32

GetErrorInfo
SysStringLen
SysFreeString

uxtheme

SetWindowTheme

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 662KB - Virtual size: 662KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c884bffaccfe2cb26ddd238ff977fa71

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

bcrypt

advapi32

kernel32

user32

shell32

ole32

imm32

gdi32

dwmapi

winmm

oleaut32

uxtheme

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 662KB - Virtual size: 662KB

.data Size: 4KB - Virtual size: 53KB

.pdata Size: 58KB - Virtual size: 57KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 662KB - Virtual size: 662KB

.data
Size: 4KB - Virtual size: 53KB

.pdata
Size: 58KB - Virtual size: 57KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 15KB - Virtual size: 15KB