ksa_win[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ksa_win.exe
Size

4.0MB
MD5

acb87efefb9f67a6770798b823e8069b
SHA1

af6c28e25ecd81584f5b72db6a975ddec3c0a849
SHA256

10ac45fa3c999cb3bb267e379a3d775a771d89fe6cd21cb64bc1bd7aec14c3c6
SHA512

5db6f99987ce5de59b172d91731b955137f51198e5a98433cd856e0ecc3be6d83d0219d0ca20b0634d8daf9faa011d54504001769db30533bb22a438c79d35f1
SSDEEP

49152:aPF82SY1go6wTLJSm3VBoD5vxrF42no93BvBZg6P9EzTvYP3G193kB9dkPiTFPTA:MF82SY1g0geAFvFFU1BvBieEa215+dg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ksa_win.exe

Files

ksa_win.exe
.exe windows:5 windows x86 arch:x86

e8e0fd3096af6258d2bcda636466dd6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\projects\fcn_project\client\windows\wxGui\Release\wxGui.pdb

Imports

kernel32

CreateFileW
Sleep
InterlockedExchangeAdd
FreeLibrary
GetProcAddress
GetVersion
GetOverlappedResult
ResetEvent
WriteFile
CreateEventW
LoadLibraryW
GetModuleHandleA
CreateFileA
WideCharToMultiByte
LocalAlloc
LocalFree
lstrcmpW
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
CloseHandle
WaitForSingleObject
CreateThread
GetSystemTimeAsFileTime
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetVersionExW
GetLastError
ReadFile
GetTickCount
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
VirtualQuery
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetModuleHandleExW
SetConsoleCtrlHandler
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetStringTypeW
ExitThread
FreeLibraryAndExitThread
GetFileAttributesExW
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
DeleteFileW
MoveFileExW
CreateDirectoryW
RemoveDirectoryW
GetFullPathNameW
GetFullPathNameA
SetStdHandle
GetModuleFileNameA
HeapFree
HeapAlloc
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
EnumSystemLocalesW
GetCurrentThread
GetCurrentDirectoryW
DecodePointer
GetOEMCP
SetEndOfFile
WriteConsoleW
FindFirstFileExA
FindFirstFileExW
FindNextFileA
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OutputDebugStringW
GetTempPathW
MultiByteToWideChar
CreateMutexW
GetModuleHandleW
CreateProcessW
GetCommandLineW
GetWindowsDirectoryA
SetCurrentDirectoryW
GetVolumeInformationA
GetComputerNameA
ProcessIdToSessionId
TlsAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
GetSystemTime
SystemTimeToFileTime
GetStdHandle
GetFileType
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetErrorMode
SizeofResource
LockResource
LoadResource
FindResourceW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GlobalSize
HeapSize
GetProcessHeap
GetLocaleInfoW
SetThreadLocale
GetUserDefaultLCID
GetACP
SetEnvironmentVariableA
OutputDebugStringA
WaitForSingleObjectEx
IsValidLocale
ReleaseMutex
CreateSemaphoreW
ReleaseSemaphore
TlsSetValue
ExitProcess
InterlockedDecrement
SetThreadPriority
TerminateThread
GetExitCodeThread
InterlockedIncrement
SuspendThread
ResumeThread
TlsGetValue
GetSystemInfo
GetProcessAffinityMask
TlsFree
GetComputerNameW
GetProfileStringW
GetDiskFreeSpaceW
SetEnvironmentVariableW
GetExitCodeProcess
OpenProcess
GetCPInfo
IsValidCodePage
GetFileAttributesW
CopyFileW
GetWindowsDirectoryW
GetTimeZoneInformation
GetThreadLocale
ExpandEnvironmentStringsW
CreatePipe
DuplicateHandle
SetNamedPipeHandleState
PeekNamedPipe
IsBadReadPtr
IsBadStringPtrA
RaiseException
GetFileSize
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
LocalFileTimeToFileTime
SetFileTime
GetShortPathNameW
GetTempFileNameW
IsProcessorFeaturePresent

user32

AppendMenuW
CreateMenu
GetSubMenu
GetMenuItemCount
DestroyWindow
SetFocus
SendMessageW
ClientToScreen
GetFocus
EnableWindow
ShowWindow
SetWindowPos
SetCapture
ReleaseCapture
GetCapture
SetCursor
PtInRect
GetWindowRect
GetCursorPos
SetCursorPos
GetScrollInfo
SetScrollInfo
ScrollWindow
SetWindowLongW
GetWindowLongW
IsWindow
GetParent
WindowFromPoint
SetParent
RedrawWindow
UpdateWindow
GetClientRect
DrawMenuBar
RegisterWindowMessageW
DdeGetLastError
DdeFreeStringHandle
DdeQueryStringW
DdeCreateStringHandleW
DdeCreateDataHandle
DdePostAdvise
DdeGetData
DdeFreeDataHandle
DdeClientTransaction
DdeDisconnect
DdeConnect
DdeNameService
DdeUninitialize
DdeInitializeW
WaitForInputIdle
MessageBeep
ExitWindowsEx
EnumWindows
GetWindowThreadProcessId
PostThreadMessageW
MsgWaitForMultipleObjects
ShowCursor
EnumDisplaySettingsW
ChangeDisplaySettingsW
GetClipboardFormatNameW
EnumClipboardFormats
GetClipboardData
RegisterClipboardFormatW
GetDC
EmptyClipboard
RemoveMenu
SetMenuItemInfoW
InsertMenuItemW
CreateIconIndirect
InsertMenuW
DestroyMenu
CreatePopupMenu
ModifyMenuW
CheckMenuRadioItem
CheckMenuItem
EnableMenuItem
GetMenuState
ScreenToClient
GetMenuStringW
DefMDIChildProcW
TranslateMDISysAccel
DefFrameProcW
GetMessagePos
UnionRect
GetMessageW
ValidateRect
GetWindowDC
DrawIconEx
TranslateAcceleratorW
CreateAcceleratorTableW
LoadAcceleratorsW
DestroyAcceleratorTable
DrawStateW
ReleaseDC
GetIconInfo
LoadIconW
DrawFrameControl
DrawEdge
GetClassNameW
GetWindowTextW
MapWindowPoints
GetClassInfoW
ChildWindowFromPoint
ShowCaret
HideCaret
OpenClipboard
IsClipboardFormatAvailable
CloseClipboard
keybd_event
GetWindowTextLengthW
LoadCursorW
LoadCursorFromFileW
DestroyCursor
GetUpdateRect
BeginPaint
DrawIcon
EndPaint
SetMenu
PostMessageW
KillTimer
SetTimer
SetForegroundWindow
GetForegroundWindow
DrawTextW
CopyRect
DrawFocusRect
OffsetRect
RegisterClassW
UnregisterClassW
FlashWindow
SetWindowRgn
GetMenu
AdjustWindowRectEx
GetSystemMenu
GetDesktopWindow
IsIconic
IsZoomed
BringWindowToTop
CreateDialogIndirectParamW
GetDlgItem
CreateDialogParamW
UnregisterHotKey
RegisterHotKey
LoadImageW
GetSystemMetrics
DestroyIcon
LoadBitmapW
GetUserObjectInformationW
GetProcessWindowStation
SetClipboardData
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetActiveWindow
GetAsyncKeyState
VkKeyScanW
GetMenuItemInfoW
SystemParametersInfoW
GetMessageTime
GetWindow
BeginDeferWindowPos
EndDeferWindowPos
FillRect
GetUpdateRgn
GetSysColor
InvalidateRect
SetWindowTextW
CreateWindowExW
InflateRect
IsWindowEnabled
IsWindowVisible
GetKeyState
IsDialogMessageW
CallWindowProcW
DefWindowProcW
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
TrackPopupMenu
DeferWindowPos
MoveWindow
MessageBoxW

gdi32

EndPage
StartPage
EndDoc
StartDocW
CreateDCW
SetAbortProc
GetSystemPaletteEntries
GetMetaFileBitsEx
SetWinMetaFileBits
GetWinMetaFileBits
SetMetaFileBitsEx
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
DeleteEnhMetaFile
CopyEnhMetaFileW
GetEnhMetaFileW
EnumFontFamiliesExW
CreateBitmapIndirect
CreateICW
PatBlt
RestoreDC
SaveDC
StretchDIBits
StretchBlt
GetTextExtentExPointW
GetCharABCWidthsW
SetROP2
TextOutW
SetStretchBltMode
MaskBlt
PolyBezier
Ellipse
RoundRect
Rectangle
Polyline
PolyPolygon
SetPolyFillMode
Polygon
SetPixel
Pie
Arc
GetPixel
ExtFloodFill
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
ExtSelectClipRgn
GetClipBox
GetTextColor
GetBkColor
PtInRegion
EqualRgn
GetRgnBox
CreatePolygonRgn
CreateDIBitmap
GetDIBColorTable
GetDIBits
CreateDIBSection
MoveToEx
LineTo
GetNearestPaletteIndex
CreatePalette
ExtCreatePen
GetStockObject
CreateHatchBrush
SetBrushOrgEx
CreatePatternBrush
SelectClipRgn
SetTextAlign
RectInRegion
CreateRectRgnIndirect
CombineRgn
CreatePen
CreateSolidBrush
SetBkMode
SetTextColor
GetRegionData
ExtCreateRegion
OffsetRgn
CreateRectRgn
SelectPalette
RealizePalette
ExcludeClipRect
GetTextExtentPoint32W
GetTextMetricsW
GdiFlush
GetDeviceCaps
CreateFontIndirectW
GetPaletteEntries
SetBkColor
BitBlt
CreateCompatibleDC
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateBitmap
DeleteObject
GetObjectW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

comdlg32

ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
PageSetupDlgW
ChooseColorW

advapi32

SystemFunction036
RegCloseKey
RegQueryValueExA
RegSetValueExA
ChangeServiceConfigW
CloseServiceHandle
ControlService
CreateServiceW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatusEx
StartServiceW
GetUserNameW
RegDeleteValueW
RegOpenKeyW
RegSetValueExW
DeleteService
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyExW
RegQueryInfoKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt

shell32

DragAcceptFiles
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
DragQueryFileW
DragQueryPoint
DragFinish
ExtractIconExW
ExtractIconW
ShellExecuteExA

ole32

OleIsCurrentClipboard
OleSetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleUninitialize
OleFlushClipboard
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
OleGetClipboard
OleInitialize
ReleaseStgMedium

oleaut32

SysStringLen
SysAllocString

ws2_32

getnameinfo
freeaddrinfo
WSASetLastError
WSAStartup
getaddrinfo
WSAIoctl
listen
inet_ntoa
ioctlsocket
send
recv
getpeername
select
getsockopt
__WSAFDIsSet
WSACleanup
socket
inet_addr
WSAGetLastError
sendto
recvfrom
getsockname
connect
closesocket
bind
accept
shutdown
setsockopt
ntohs
ntohl
htons
htonl
gethostbyname

iphlpapi

IcmpCreateFile
IcmpSendEcho2
IcmpParseReplies
GetAdaptersInfo
GetIpForwardTable
CreateIpForwardEntry
DeleteIpForwardEntry
GetInterfaceInfo
IpReleaseAddress
GetIfTable
NotifyRouteChange
IcmpCloseHandle

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdA
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

dbghelp

MiniDumpWriteDump

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_Add
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_Draw
ImageList_SetBkColor
ImageList_GetIcon
CreateStatusWindowW
ord17
ord16
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 685KB - Virtual size: 684KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 520KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8e0fd3096af6258d2bcda636466dd6e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

setupapi

dbghelp

comctl32

crypt32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 685KB - Virtual size: 684KB

.data Size: 520KB - Virtual size: 736KB

.gfids Size: 1KB - Virtual size: 1KB

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 195KB - Virtual size: 194KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 685KB - Virtual size: 684KB

.data
Size: 520KB - Virtual size: 736KB

.gfids
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 195KB - Virtual size: 194KB