teres[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

teres.exe
Size

2.7MB
MD5

70fe98bc2b94967099b7fcc6f4e5b705
SHA1

51edd9d7c8811619c476704244c49c483ad66986
SHA256

baad42351267cb00b0316eb8b85ed42655f356dc70643d6fa2aefa1ccfd8c47d
SHA512

a4ddf46c334277584f815b69c180823eff365a65dd09b590282d08e154029c304733cc4bfbc7407d862a9ee52534f0e1dc90abf90d211672c8b21e1fc2540226
SSDEEP

49152:vftBolmByfFGuDHkC3AuOT65neLq391G2LjDzvMD:tBorA6nZjDzv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
teres.exe

Files

teres.exe
.exe windows:6 windows x64 arch:x64

54505b893d2fa0eb15ff9e51999902d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\teres\teres\target\release\deps\teres.pdb

Imports

bcrypt

BCryptGenRandom

kernel32

CreateMutexA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
LoadLibraryA
WaitForSingleObjectEx
GetProcAddress
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
RtlCaptureContext
FormatMessageW
GetCurrentThread
FreeLibrary
GetFileInformationByHandleEx
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
GetCurrentProcess
lstrlenW
ReleaseMutex
RtlLookupFunctionEntry
ReleaseSemaphore
FreeEnvironmentStringsW
GetCommandLineW
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
AcquireSRWLockExclusive
SetFileInformationByHandle
DuplicateHandle
SetConsoleTitleA
SetConsoleCursorPosition
SetConsoleTextAttribute
GetCurrentProcessId
WriteFileEx
SleepEx
ReadFileEx
GetExitCodeProcess
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
GetModuleHandleA
FindNextFileW
CreateFileW
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
CreateEventW
ReadFile
GetOverlappedResult
CancelIo
GetModuleHandleW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
FillConsoleOutputAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTempPathW
SetConsoleMode
GetConsoleMode
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetStdHandle
ReleaseSRWLockExclusive
SetConsoleCtrlHandler
CreateSemaphoreA
CloseHandle
WaitForSingleObject
SetFilePointerEx
IsProcessorFeaturePresent

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree

shell32

SHCreateItemFromParsingName
SHGetKnownFolderPath

oleaut32

SysFreeString
GetErrorInfo
SysStringLen

advapi32

SystemFunction036

ntdll

NtCreateFile
RtlNtStatusToDosError
NtWriteFile
NtReadFile

vcruntime140

_CxxThrowException
memset
memmove
__CxxFrameHandler3
memcpy
memcmp
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-math-l1-1-0

round
truncf
trunc
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm
_set_app_type
exit
_exit
_configure_narrow_argv
_initialize_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initterm_e
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54505b893d2fa0eb15ff9e51999902d3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

kernel32

ole32

shell32

oleaut32

advapi32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 817KB - Virtual size: 817KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 76KB - Virtual size: 76KB

.rsrc Size: 512B - Virtual size: 504B

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 817KB - Virtual size: 817KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 76KB - Virtual size: 76KB

.rsrc
Size: 512B - Virtual size: 504B

.reloc
Size: 18KB - Virtual size: 18KB