Gunluk[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Gunluk.exe
Size

39.6MB
MD5

74385d396a3aaca4c9bac519888db216
SHA1

1f5a39fa71faaf2910972f11becb536572d51f70
SHA256

427b3e1b0a170cfcea6b28d464a1c2f2d0238bd22e7ae2d1c118a4cdf9837d58
SHA512

bf7f9fa43f34a9e80024d2affff4be8c1c91089bd831283d98dfaf0a1305ddfd2753dae4a8f0cfb4b1e91d2a7eabca1b2fc0a54d1416d6d9e2b5b908e4285293
SSDEEP

786432:i0ar7SICcEO9A70p8aJ5xZi8XRQfeeoV2wxlhfganBkt:Ba3e570BJ5xQieoHxlhfHnC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Gunluk.exe

Files

Gunluk.exe
.exe windows:6 windows x64 arch:x64

7230a2f8279ea6331fbd82b8cf207506

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

DefWindowProcW

shell32

ShellExecuteW

imm32

ImmReleaseContext

msvcp140

?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

wininet

InternetReadFile

ntdll

RtlAdjustPrivilege

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

isprint

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

system

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

floorf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Ok*
Size: - Virtual size: 37.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.=pV
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JG$
Size: 39.6MB - Virtual size: 39.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7230a2f8279ea6331fbd82b8cf207506

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

imm32

msvcp140

dwmapi

d3d9

wininet

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 368KB

.rdata Size: - Virtual size: 472KB

.data Size: - Virtual size: 150KB

.pdata Size: - Virtual size: 12KB

.Ok* Size: - Virtual size: 37.8MB

.=pV Size: 4KB - Virtual size: 3KB

.JG$ Size: 39.6MB - Virtual size: 39.6MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 368KB

.rdata
Size: - Virtual size: 472KB

.data
Size: - Virtual size: 150KB

.pdata
Size: - Virtual size: 12KB

.Ok*
Size: - Virtual size: 37.8MB

.=pV
Size: 4KB - Virtual size: 3KB

.JG$
Size: 39.6MB - Virtual size: 39.6MB

.rsrc
Size: 512B - Virtual size: 480B