App[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

App.exe
Size

2.4MB
MD5

e53e2e3e0a48254b625a9cbd149ef883
SHA1

39a1d1115cfdea97bebed69bae75bfb9a1dac2bd
SHA256

69cdb1b77a1316dc8e98a01a9ccc7bca0c4343c531d0b10e4ed9d74307a54f03
SHA512

50677a977f6e40b4bba5f8061f91898bd795e404951b66e0c5c228f7e4c90f84d305d1970c02ba1fe797171132ecefb03aa70689c94c64654c2ed8f739c3f4fe
SSDEEP

49152:MjpCFXZXwHZmCtJMrTEftNJO7CgMzbZJBJ3L0nMZ3NicqFrrgYRbX/nn2Y:MGZ+tJMrTB7QnZRoWEcZETb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
App.exe

Files

App.exe
.exe windows:6 windows x64 arch:x64

Password: yes

58b21df74eb733ee8783f2622cfcde2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

timeGetTime

dxgi

CreateDXGIFactory

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

d3d12

ord101

kernel32

GlobalUnlock
GlobalLock
GlobalFree
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
WaitForSingleObject
GetModuleHandleA
GetProcAddress
LoadLibraryA
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
IsProcessorFeaturePresent
RtlVirtualUnwind
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateRemoteThread
OpenProcess
VirtualAllocEx
VirtualFreeEx
GetConsoleWindow
Process32First
Process32Next
GetTickCount64
GetTickCount
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
Sleep
InitializeSListHead

user32

GetWindowLongW
SetWindowLongA
SetWindowLongW
LoadCursorA
MonitorFromWindow
GetMonitorInfoA
EnumDisplayMonitors
GetMessageA
TranslateMessage
DispatchMessageA
SendInput
GetWindowTextA
WindowFromPoint
UnhookWindowsHookEx
CallNextHookEx
PeekMessageA
PostQuitMessage
GetAsyncKeyState
UpdateWindow
FindWindowA
EmptyClipboard
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
ScreenToClient
SetWindowsHookExA
SetWindowTextW
SetWindowRgn
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
SetFocus
BringWindowToTop
IsIconic
SetWindowPos
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
IsChild
ClientToScreen
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
GetMessageExtraInfo
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
TrackMouseEvent

gdi32

CreateRoundRectRgn
GetDeviceCaps

shell32

ShellExecuteExA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Random_device@std@@YAIXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Thrd_detach
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

imm32

ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext

dwmapi

DwmSetWindowAttribute

vcruntime140

strstr
memchr
memcpy
memmove
memset
memcmp
__std_terminate
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

fmodf
acosf
ceilf
sqrtf
fminf
log
logf
pow
powf
expf
ldexp
cosf
sinf
atan2f
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

ungetc
fseek
fread
fgetc
_set_fmode
ferror
feof
__acrt_iob_func
__stdio_common_vfprintf
__p__commode
__stdio_common_vsscanf
__stdio_common_vsprintf_s
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
strncpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh
realloc

api-ms-win-crt-convert-l1-1-0

atof
strtol

api-ms-win-crt-runtime-l1-1-0

_initterm
_get_initial_narrow_environment
_exit
__p___argc
__p___argv
_register_thread_local_exe_atexit_callback
exit
terminate
_beginthreadex
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
_set_app_type
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_c_exit
_seh_filter_exe

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 579KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: yes

58b21df74eb733ee8783f2622cfcde2b

Headers

DLL Characteristics

File Characteristics

Imports

winmm

dxgi

d3dcompiler_47

d3d11

d3d12

kernel32

user32

gdi32

shell32

msvcp140

imm32

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 579KB - Virtual size: 579KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 4KB - Virtual size: 17KB

.pdata Size: 25KB - Virtual size: 24KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 1020B

.text
Size: 579KB - Virtual size: 579KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 1020B