6772[.]png | Triage™

General

Target
6772.png
Size 840KB
Sample240306-tpzy2ada9s
SHA256 238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
MD5 4b1518535af6344af39bd90aa02a6c0d
SHA1 183b74ec94b19c1f4af194e4d606270053669913
SHA512 8644ec984504f56336fe583c61f4e86c103550eb9f8cf27c6342251da13ef2d0dff132bd2256fbe8e1958da788e0f9738636e9b1438851784934427ec7006cb0
SSDEEP 24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6772.png

File Explorer

6772.png

.dll 840KB

6772.png

IMPHASH 55f1ba0b782341fa929d61651ef47f0c
SHA256 238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
MD5 4b1518535af6344af39bd90aa02a6c0d
SHA1 183b74ec94b19c1f4af194e4d606270053669913
SHA512 8644ec984504f56336fe583c61f4e86c103550eb9f8cf27c6342251da13ef2d0dff132bd2256fbe8e1958da788e0f9738636e9b1438851784934427ec7006cb0
SSDEEP 24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

189353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Jenkins\workspace\Osprey\Osprey_5.01\output\app\symbol\Win32\Release\TmopphDns.pdb

kernel32

WideCharToMultiByte CreateDirectoryA Sleep LocalFree LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WriteConsoleW GetProcAddress ResetEvent CloseHandle LoadLibraryA SetEvent GetLastError MultiByteToWideChar OpenEventW GetModuleFileNameW GetShortPathNameW SetLastError OpenEventA GetModuleFileNameA GetShortPathNameA EnterCriticalSection GetVersionExA HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW FormatMessageW InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList FreeLibrary LoadLibraryExW CreateFileW GetFileType ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetCurrentThread GetFileAttributesExW WriteFile GetConsoleCP GetConsoleMode SetStdHandle SetEndOfFile ReadFile ReadConsoleW SetFilePointerEx GetFileSizeEx FlushFileBuffers DeleteFileW HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW OutputDebugStringW

advapi32

GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel UnregisterTraceGuids RegisterTraceGuidsA GetSecurityDescriptorSacl SetEntriesInAclA GetSecurityDescriptorDacl SetNamedSecurityInfoA ConvertStringSecurityDescriptorToSecurityDescriptorA TraceMessage GetNamedSecurityInfoA SetSecurityInfo ConvertStringSidToSidA ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sharing