powder[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

powder.zip
Size

2.9MB
MD5

eb55d0499e206b889063fe59d5734552
SHA1

4b18907ac1f74551f07767e6d113d319a1e368bb
SHA256

37e0915aaf29d38fd28067d0d90e54c48ed1f8a00a095e31a375eba913ec82a3
SHA512

507b695bf46e934fdcfe415f3425aa1ffb8dd3a291434fa8a48bbdf4a2e61510ad7e7f036c8df2f45a58288b6ea6ab00ec7ef4548076a4866b533dd11f419098
SSDEEP

49152:fb1HpgQA1VYCGWtqs5KYMAHdyb4GQv4nKsVrDVq+a94f4Zfr3EFo4SZ7Ly7HqCg0:ZHGQA1mCGWtqsPjGuWKYNe4f4FESJp+3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Powder.exe

Files

powder.zip
.zip
Powder.exe
.exe windows:6 windows x64 arch:x64

e6f8e93e290c2b38c8e365a15a506a15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\The-Powder-Toy\The-Powder-Toy\build\powder.pdb

Imports

crypt32

CertOpenSystemStoreW
CryptBinaryToStringA
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateContext

dbghelp

SymGetModuleBase64
SymFromAddrW
StackWalk64
SymCleanup
SymGetModuleInfoW64
SymFunctionTableAccess64
SymInitialize

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetIMEFileNameA
ImmGetContext

winmm

timeBeginPeriod
timeEndPeriod

wsock32

listen
htonl
accept
WSACleanup
WSAStartup
select
__WSAFDIsSet
WSASetLastError
recv
ntohs
getsockopt
getsockname
getpeername
connect
bind
socket
htons
WSAGetLastError
closesocket
setsockopt
send
inet_ntoa

ws2_32

freeaddrinfo
getaddrinfo
inet_ntop
inet_pton
WSAIoctl
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent

bcrypt

BCryptGenRandom

kernel32

GetTempPathW
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetLastError
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
Sleep
GetSystemTimeAsFileTime
SetLastError
GetModuleFileNameW
GetFileAttributesW
GetACP
MultiByteToWideChar
MoveFileExW
SetConsoleCP
WideCharToMultiByte
SetConsoleOutputCP
GetTickCount
RtlCaptureContext
GetCurrentProcess
GetCurrentThread
ExitProcess
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
CreateDirectoryW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
WriteFile
CloseHandle
SetErrorMode
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetThreadExecutionState
GetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
SetThreadPriority
FreeLibrary
LoadLibraryW
MulDiv
GetModuleHandleExW
ReleaseSemaphore
CreateSemaphoreW
VerSetConditionMask
LoadLibraryExW
FormatMessageW
HeapReAlloc
CompareStringA
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwindEx
VirtualFree
VirtualQuery
GetModuleHandleA
InitializeCriticalSection
WaitForSingleObject
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleExA
FormatMessageA
VirtualAlloc
VirtualProtect
FlsGetValue
AcquireSRWLockExclusive
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryA
LoadLibraryA
MoveFileExA
ReleaseMutex
CreateMutexA
FindClose
FindFirstFileW
FindNextFileW
lstrlenW
FreeLibraryAndExitThread
ExitThread
CreateProcessW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
RemoveDirectoryW
DeleteFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
WriteConsoleW
GetFileType
GetStdHandle
SetConsoleCtrlHandler
InterlockedFlushSList
InterlockedPushEntrySList
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
GetStringTypeW
AcquireSRWLockShared
ReleaseSRWLockShared
GetExitCodeThread
SwitchToThread
DuplicateHandle
DecodePointer
EncodePointer
RtlPcToFileHeader
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
CreateEventW
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
SetEndOfFile
IsValidCodePage
GetOEMCP
RtlUnwind
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
CreateTimerQueue
FlsSetValue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
FlsAlloc
FlsFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
FlushFileBuffers
ReleaseSRWLockExclusive
GetTimeZoneInformation
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
GetVersionExW
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
LocalFree
VerifyVersionInfoW

user32

EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
MapVirtualKeyW
ToUnicode
GetKeyboardLayout
GetRawInputData
DestroyIcon
LoadIconW
CallNextHookEx
GetCursorPos
SetCursor
GetPropW
ValidateRect
InvalidateRect
MonitorFromPoint
ReleaseCapture
SetTimer
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoExW
RegisterClassExW
CallWindowProcW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
SetWindowRgn
RegisterRawInputDevices
CreateIconIndirect
CopyImage
LoadCursorW
GetUpdateRect
SetCursorPos
SetCapture
IsClipboardFormatAvailable
SetClipboardData
GetClipboardSequenceNumber
KillTimer
EnumDisplayMonitors
MonitorFromRect
CreateIconFromResource
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
GetParent
SetWindowLongW
GetWindowLongW
IsRectEmpty
IntersectRect
ClipCursor
ScreenToClient
ClientToScreen
GetClipCursor
GetClipboardData
EmptyClipboard
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RemovePropW
SetPropW
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
GetMenu
GetKeyboardState
GetFocus
SetWindowPos
FlashWindowEx
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
AttachThreadInput
SendMessageW
SystemParametersInfoW
SystemParametersInfoA
SetWindowLongPtrW
GetWindowLongPtrW
ReleaseDC
GetDC
DrawTextW
GetSystemMetrics
SetFocus
GetDlgItem
EndDialog
DialogBoxIndirectParamW
PostMessageW
RegisterWindowMessageA
GetDoubleClickTime
RegisterClipboardFormatW
GetClipboardOwner
OpenClipboard
CloseClipboard
PtInRect

gdi32

CreateDIBSection
CreateCompatibleBitmap
GetDIBits
CreateBitmap
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
BitBlt
CombineRgn
CreateRectRgn
SetDeviceGammaRamp
GetDeviceGammaRamp
GetICMProfileW
CreateDCW
GetTextMetricsW
SelectObject
GetTextExtentPoint32A
GetDeviceCaps
DeleteDC
CreateFontIndirectW
DeleteObject
CreateCompatibleDC

shell32

DragFinish
DragQueryFileW
DragAcceptFiles
SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW
ExtractIconExW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString

advapi32

CryptGetHashParam
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
CryptGenRandom
CryptDestroyHash
CryptHashData
CryptCreateHash
RegSetValueExW
CryptReleaseContext
CryptAcquireContextA

Exports

Exports

__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
license.txt
readme.txt

Sharing

General

Malware Config

Signatures

Files

e6f8e93e290c2b38c8e365a15a506a15

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

dbghelp

version

imm32

winmm

wsock32

ws2_32

bcrypt

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

Exports

Exports

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 114KB - Virtual size: 340KB

.pdata Size: 192KB - Virtual size: 191KB

.gxfg Size: 20KB - Virtual size: 20KB

.gehcont Size: 512B - Virtual size: 36B

_RDATA Size: 5KB - Virtual size: 4KB

.rsrc Size: 96KB - Virtual size: 96KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 4.8MB - Virtual size: 4.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 114KB - Virtual size: 340KB

.pdata
Size: 192KB - Virtual size: 191KB

.gxfg
Size: 20KB - Virtual size: 20KB

.gehcont
Size: 512B - Virtual size: 36B

_RDATA
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 96KB - Virtual size: 96KB

.reloc
Size: 22KB - Virtual size: 22KB