xpajB[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

xpajB.exe
Size

520KB
MD5

bd76fc01deed43cd6e368a1f860d44ed
SHA1

a2e241e9af346714e93c0600f160d05c95839768
SHA256

e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf
SHA512

d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec
SSDEEP

12288:Kbx6vZrcRsEQNMnnGpL0zTnPzCFjBL0C2k8apE:Kbx6vam9innGWzUB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xpajB.exe

Files

xpajB.exe
.exe windows:5 windows x86 arch:x86

1dca2dbd3757a754f369f518971d3efd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

nmas.pdb

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free

kernel32

GetOEMCP
GetCurrentThreadId
IsDebuggerPresent
GetLogicalDrives
GetVersion
SetLastError
lstrcatA
GetConsoleOutputCP
GetProcessHeap
LocalFree
LocalAlloc
GetACP
GlobalFree
GetConsoleCP
VirtualAlloc
GetStartupInfoA
GetUserDefaultLCID
LoadLibraryA
GetLastError
GetEnvironmentStringsA
IsSystemResumeAutomatic
DeleteCriticalSection
lstrcpynA
GetCommandLineW
OpenEventA
WriteFile
CreateFileA
ReadFile
lstrcmpA
InterlockedDecrement
lstrlenA
GlobalAlloc
lstrcpyA
GetSystemDefaultLCID
GetUserDefaultLangID
InterlockedIncrement
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetCurrentProcess
GetThreadLocale
FreeEnvironmentStringsA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
GetModuleHandleA
GetProcAddress
CompareStringA

advapi32

RegCreateKeyExA
RegCreateKeyA
RegFlushKey
RegSetValueExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

GetInputState
GetClipboardViewer
LoadBitmapA
LoadImageA
CharNextW
GetIconInfo
DestroyCursor
GetCursor
WindowFromPoint
GetCursorPos
GetCapture
CreateCursor
GetClipboardOwner
GetWindowDC
CharUpperA
CharPrevA
CharNextA
DrawIcon
GetForegroundWindow
IsWindow
GetLastActivePopup
IsWindowEnabled
GetUserObjectInformationA
GetThreadDesktop
CloseDesktop
OpenInputDesktop
IsRectEmpty
GetWindowRect
SetPropA
GetWindowRgn
ShowOwnedPopups
InvalidateRgn
GetClientRect
MoveWindow
DeleteMenu
GetMenuItemCount
ModifyMenuA
GetSubMenu
AdjustWindowRectEx
EndPaint
BeginPaint
SetScrollPos
ScrollWindowEx
ClientToScreen
ScreenToClient
SetScrollInfo
OffsetRect
DrawFrameControl
DestroyMenu
MapWindowPoints
GetDlgItemTextA
SetRect
SetMenu
SetCapture
ReleaseCapture
GetDoubleClickTime
DrawMenuBar
GetKeyState
GetMenuState
LoadMenuA
GetMenuItemInfoA
SetFocus
RegisterClassExA
MapVirtualKeyA
GetClipCursor
OemToCharBuffA
CharToOemBuffA
VkKeyScanA
ToAscii
IsDlgButtonChecked
ShowWindow
IsIconic
SetForegroundWindow
SetWindowPos
SetRectEmpty
GetWindowTextA
SendMessageTimeoutA
GetClassLongA
CopyImage
InvalidateRect
UpdateWindow
GetSystemMenu
EnableMenuItem
InsertMenuItemA
GetWindow
GetWindowTextLengthA
SetDlgItemTextA
CheckDlgButton
IsWindowVisible
EnumWindows
GetClassNameA
GetDlgItem
GetFocus
EnableWindow
LoadCursorA
SetCursor
GetSysColor
GetSysColorBrush
FillRect
DrawFocusRect
InflateRect
DrawIconEx
SendMessageA
DrawTextA
SendDlgItemMessageA
GetDC
ReleaseDC
LoadStringA
SetWindowTextA
GetShellWindow
RemovePropA
GetPropA
CountClipboardFormats
GetProcessDefaultLayout
DestroyIcon
RegisterClassA
DefWindowProcA
KillTimer
UnregisterClassA
DestroyWindow
CreateWindowExA
SetWindowLongA
SetTimer
wsprintfA
PtInRect
IsDialogMessageA
GetKeyboardState
SetKeyboardState
GetWindowLongA
GetParent
GetDesktopWindow
GetSystemMetrics
SetCursorPos
ChangeDisplaySettingsExA
ChangeDisplaySettingsA
OpenDesktopA
SetThreadDesktop
FindWindowA
GetCaretBlinkTime
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
RedrawWindow
keybd_event
mouse_event
PostThreadMessageA
PostMessageA
CallNextHookEx
GetActiveWindow

gdi32

CreateDIBitmap
GetDIBits
CreateDIBSection
PatBlt
RealizePalette
SelectPalette
CreateCompatibleBitmap
OffsetRgn
SetRectRgn
CombineRgn
CreateRectRgn
GetRgnBox
GetRegionData
SetPixel
SetPaletteEntries
GetSystemPaletteUse
GetSystemPaletteEntries
CreatePalette
CreateBitmap
SetDIBColorTable
GetTextExtentPointA
GetClipBox
FillRgn
UnrealizeObject
SetBrushOrgEx
SelectClipRgn
SetBkMode
CreatePatternBrush
SetDIBits
SetTextAlign
GetTextAlign
LPtoDP
CreateBrushIndirect
SetBitmapBits
CreatePen
SetROP2
SetTextCharacterExtra
SetTextJustification
SetPolyFillMode
SetArcDirection
Rectangle
Polygon
Pie
Ellipse
Arc
Chord
PolyBezier
RoundRect
LineTo
MoveToEx
ExtTextOutA
TextOutA
GetCharWidthA
GetCharABCWidthsA
EnumFontFamiliesA
CreateFontA
GetDeviceCaps
GetStockObject
GetObjectA
CreateFontIndirectA
SetBkColor
SetTextColor
CreateCompatibleDC
BitBlt
DeleteDC
SelectObject
PtInRegion
DeleteObject
GetTextExtentPoint32A
CreateHatchBrush
StretchDIBits
GetTextMetricsA

atmlib

ATMEndFontChange
ATMFontAvailable
ATMFontAvailableA

dnsapi

DnsWriteQuestionToBuffer_UTF8
DnsIsAMailboxType
DnsAllocateRecord
DnsStatusString
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterTerm
DnsNameCompareEx_A
DnsApiHeapReset
DnsDowncaseDnsNameLabel
DnsUpdate

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dca2dbd3757a754f369f518971d3efd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

user32

gdi32

atmlib

dnsapi

Sections

.text Size: 196KB - Virtual size: 195KB

.data Size: 300KB - Virtual size: 302KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 196KB - Virtual size: 195KB

.data
Size: 300KB - Virtual size: 302KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 8KB