1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.exe
Size 7.9MB
Sample240403-xlcacaaa72
SHA256 577066c5dd6d992ef8879cec6c006a820706d4199406efa2ac60e7191c8ed481
MD5 edad028afad7d751e95aa524b812fef4
SHA1 de399cbf29bd5ca367c723288c8cb55048c44446
SHA512 ca23721b8e896830b7b0c1fedff87fff4e5d67b3dc796a851990692a2852b0c74cc44fd6a3d5a54dbd8849efd18cff07d8c15987fcd5e7d0da4abc96b99733c8
SSDEEP 98304:wWqqoMV8F4Tab14wQ2zLT0VbdGfNBODVG:dV4b11zdHE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1.exe

File Explorer

1.exe

.exe 7.9MB

1.exe

IMPHASH 6f3e3551c7aaf5099b2fa152a73502d1
SHA256 577066c5dd6d992ef8879cec6c006a820706d4199406efa2ac60e7191c8ed481
MD5 edad028afad7d751e95aa524b812fef4
SHA1 de399cbf29bd5ca367c723288c8cb55048c44446
SHA512 ca23721b8e896830b7b0c1fedff87fff4e5d67b3dc796a851990692a2852b0c74cc44fd6a3d5a54dbd8849efd18cff07d8c15987fcd5e7d0da4abc96b99733c8
SSDEEP 98304:wWqqoMV8F4Tab14wQ2zLT0VbdGfNBODVG:dV4b11zdHE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3694816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TryAcquireSRWLockExclusive FindClose HeapFree CloseHandle GetLastError Sleep GlobalLock GlobalSize WideCharToMultiByte MultiByteToWideChar GlobalAlloc SetFileAttributesW GetConsoleWindow MoveFileExW IsDebuggerPresent OpenProcess GetCommandLineW GetVersionExW GetComputerNameExW AcquireSRWLockExclusive ReleaseSRWLockExclusive AddVectoredExceptionHandler SetThreadStackGuarantee HeapAlloc GetProcessHeap HeapReAlloc RemoveDirectoryW DeleteFileW GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute GetTickCount64 GetLogicalDrives GlobalFree GlobalUnlock lstrlenW LoadLibraryA GetProcAddress CreateFileW GetModuleFileNameW SetFileInformationByHandle SwitchToThread SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes WakeAllConditionVariable SleepConditionVariableSRW WakeConditionVariable GetSystemInfo GetFileInformationByHandle SetHandleInformation GetModuleHandleA GetCurrentThread WaitForSingleObject WriteConsoleW CreateWaitableTimerExW SetWaitableTimer QueryPerformanceFrequency GetModuleHandleW FormatMessageW GetCurrentProcess GetEnvironmentVariableW GetTempPathW GetFileInformationByHandleEx GetFullPathNameW SetFilePointerEx FindNextFileW CreateDirectoryW FindFirstFileW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CreateEventW CancelIo ReadFile ExitProcess QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx ReleaseMutex RtlVirtualUnwind AcquireSRWLockShared ReleaseSRWLockShared CopyFileExW GetFileType GetDiskFreeSpaceExW LocalFree ReadProcessMemory GetProcessTimes GetSystemTimes GetProcessIoCounters VirtualQueryEx GetDriveTypeW GetVolumeInformationW DeviceIoControl GlobalMemoryStatusEx PostQueuedCompletionStatus LoadLibraryExA FreeLibrary GetDiskFreeSpaceA FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter

ntdll

NtCancelIoFileEx NtCreateFile RtlNtStatusToDosError NtWriteFile NtQuerySystemInformation RtlGetVersion NtDeviceIoControlFile NtQueryInformationProcess NtReadFile

crypt32

CertCloseStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptUnprotectData CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain

advapi32

RegQueryValueExW RegSetValueExW LookupAccountSidW GetLengthSid IsValidSid GetTokenInformation OpenProcessToken SystemFunction036 CopySid RegCloseKey RegOpenKeyExW

user32

EmptyClipboard SetClipboardData ShowWindow CloseClipboard OpenClipboard EnumDisplayMonitors EnumDisplaySettingsExW GetDpiForSystem GetClipboardData GetMonitorInfoW

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA GetModuleFileNameExW GetPerformanceInfo

gdi32

GetDeviceCaps CreateCompatibleBitmap SelectObject SetStretchBltMode CreateDCW StretchBlt CreateCompatibleDC GetDIBits GetObjectW DeleteObject DeleteDC

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoInitializeSecurity

iphlpapi

GetAdaptersAddresses GetIfTable2 FreeMibTable GetIfEntry2

netapi32

NetUserGetLocalGroups NetUserEnum NetUserGetInfo NetApiBufferFree

secur32

InitializeSecurityContextW FreeCredentialsHandle LsaEnumerateLogonSessions LsaGetLogonSessionData LsaFreeReturnBuffer QueryContextAttributesW DecryptMessage FreeContextBuffer AcquireCredentialsHandleA DeleteSecurityContext EncryptMessage ApplyControlToken AcceptSecurityContext

shell32

SHGetKnownFolderPath CommandLineToArgvW

ws2_32

WSAGetLastError getpeername getsockname freeaddrinfo WSAStartup WSACleanup send WSAIoctl bind setsockopt recv shutdown closesocket WSASocketW ioctlsocket connect getaddrinfo getsockopt WSASend

bcrypt

BCryptGenRandom

oleaut32

SysStringLen GetErrorInfo SysAllocString SysFreeString VariantClear

pdh

PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhOpenQueryA PdhCollectQueryData

powrprof

CallNtPowerInformation

vcruntime140

memcmp __CxxFrameHandler3 memset memcpy memmove __current_exception_context strrchr __C_specific_handler __current_exception

api-ms-win-crt-string-l1-1-0

wcslen strcmp strcspn strncmp strspn strlen

api-ms-win-crt-math-l1-1-0

round _dclass log fabs roundf __setusermatherr

api-ms-win-crt-heap-l1-1-0

_msize malloc realloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _endthreadex _initialize_narrow_environment _register_onexit_function _initialize_onexit_table _configure_narrow_argv _beginthreadex _initterm _seh_filter_exe _register_thread_local_exe_atexit_callback terminate _set_app_type _initterm_e _c_exit _cexit __p___argv __p___argc exit _exit _get_initial_narrow_environment

api-ms-win-crt-locale-l1-1-0

_configthreadlocale