Start_0064[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Start_0064.exe
Size 51.4MB
Sample240529-lcsp7aaf95
SHA256 4c49db64d745b1b309dcb11043c1a01693d9cc1dc691490e1c5566a3997a1710
MD5 0a65e20a10d16448045bf818e6c56837
SHA1 8a6d57cbdb34fa5e56836a02d8c82e2824e234c2
SHA512 206ce05e49d69f221a5381f2918ae5336cd25b574e831e6a5178fc3f5a8470a2dcb44c64475ed1c8716795a1886f22da1a7f07c1570497ac50a42ae73256dbce
SSDEEP 786432:y+GLYh+tgp7h4YJNYWHaUqtYUd1EUHsv9bt:9hXpa7ZdbMn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Start_0064.exe

File Explorer

Start_0064.exe

.exe 51.4MB

Start_0064.exe

IMPHASH 9721f6f55ad5d02a82b16a27df00ec67
SHA256 4c49db64d745b1b309dcb11043c1a01693d9cc1dc691490e1c5566a3997a1710
MD5 0a65e20a10d16448045bf818e6c56837
SHA1 8a6d57cbdb34fa5e56836a02d8c82e2824e234c2
SHA512 206ce05e49d69f221a5381f2918ae5336cd25b574e831e6a5178fc3f5a8470a2dcb44c64475ed1c8716795a1886f22da1a7f07c1570497ac50a42ae73256dbce
SSDEEP 786432:y+GLYh+tgp7h4YJNYWHaUqtYUd1EUHsv9bt:9hXpa7ZdbMn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6354544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionEx FindFirstFileW SetFileTime RegisterWaitForSingleObject GetOEMCP CloseHandle DecodePointer SetFileAttributesW GlobalAlloc GetStringTypeW VerifyVersionInfoW CreateTimerQueue GetDateFormatW GetVersionExW RtlUnwind FormatMessageW CreateEventW lstrlenA HeapAlloc CreateTimerQueueTimer DuplicateHandle IsDebuggerPresent SetFilePointerEx GetACP ReleaseSemaphore InitializeSListHead SwitchToThread GetNumaHighestNodeNumber Sleep CreateThread LeaveCriticalSection CompareStringW GetModuleHandleExW TlsFree GlobalFree GetFileSize GetModuleFileNameW EncodePointer GetFileType WaitForSingleObjectEx SetEndOfFile SetUnhandledExceptionFilter GetFullPathNameW GetModuleHandleA LCMapStringW LoadLibraryW MoveFileW GetStdHandle ChangeTimerQueueTimer GetThreadPriority DeleteFileW GetCurrentThread GetFileInformationByHandle GetDriveTypeW CreateFileW FileTimeToSystemTime InitializeCriticalSection GetConsoleOutputCP SetEnvironmentVariableW GlobalLock SystemTimeToTzSpecificLocalTime MultiByteToWideChar GetLogicalDriveStringsW InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime VerSetConditionMask SetEvent GetCommandLineA InterlockedPopEntrySList TlsSetValue UnregisterWaitEx VirtualProtect HeapReAlloc CompareFileTime TlsAlloc EnterCriticalSection ExitThread GetLogicalProcessorInformation DeleteCriticalSection EnumSystemLocalesW TryEnterCriticalSection GetLastError AcquireSRWLockExclusive FindFirstFileExW FreeLibrary GetCommandLineW QueryDepthSList MoveFileExW FindNextFileW GetTickCount64 GetFileAttributesExW lstrcatA RaiseException SetLastError GetTimeZoneInformation SleepEx WaitForSingleObject WriteConsoleW GetProcessAffinityMask UnhandledExceptionFilter GetCurrentDirectoryW WriteFile SetFilePointer GetThreadTimes WideCharToMultiByte VirtualAlloc SetThreadAffinityMask GetCurrentThreadId PeekNamedPipe GetLocaleInfoW FreeLibraryAndExitThread FlushFileBuffers GetStartupInfoW GetUserDefaultLCID GetFileAttributesW IsValidCodePage ReadConsoleW GetConsoleMode QueryPerformanceFrequency InterlockedPushEntrySList QueryPerformanceCounter SetPriorityClass HeapSize ExitProcess SetStdHandle GetEnvironmentVariableA RemoveDirectoryW TerminateProcess IsProcessorFeaturePresent GetEnvironmentStringsW GlobalUnlock ReadFile UnregisterWait CreateDirectoryW GetModuleHandleW GetCPInfo WaitForMultipleObjects TlsGetValue GetTimeFormatW GetCurrentProcess GetTickCount FileTimeToLocalFileTime InterlockedFlushSList FindClose GetProcAddress LocalFree GetProcessHeap GetSystemDirectoryW CreateSemaphoreW VirtualFree FreeEnvironmentStringsW SignalObjectAndWait GlobalMemoryStatus GetFileSizeEx ResetEvent ReleaseSRWLockExclusive GetVersion HeapFree LoadLibraryExW SetThreadPriority IsValidLocale GetCurrentProcessId GetSystemInfo DeleteTimerQueueTimer

user32

GetMonitorInfoA InvalidateRect DialogBoxParamW GetWindowTextW MonitorFromWindow SetWindowTextW IsDlgButtonChecked GetWindowLongW CloseClipboard CheckDlgButton LoadStringW SetDlgItemTextW GetWindowRect KillTimer wsprintfA ScreenToClient LoadCursorW EmptyClipboard PostMessageW MessageBoxA LoadIconW ShowWindow SendMessageW SetFocus SetClipboardData SetWindowLongW EnableWindow MoveWindow MessageBoxW GetParent GetFocus EndDialog MapDialogRect GetDlgItem SetCursor GetKeyState GetWindowTextLengthW SystemParametersInfoW OpenClipboard SetTimer CharUpperW

advapi32

CryptGetHashParam CryptDestroyKey CryptImportKey CryptEncrypt CryptHashData CloseServiceHandle CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptDestroyHash

shell32

SHGetPathFromIDListW SHGetFileInfoW SHBrowseForFolderW SHGetSpecialFolderPathW

ole32

CoTaskMemFree OleInitialize CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringLen SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CertFindExtension CertCreateCertificateChainEngine CertOpenStore CertGetNameStringW CertEnumCertificatesInStore CryptStringToBinaryW PFXImportCertStore CertCloseStore CertFreeCertificateChainEngine CertFindCertificateInStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateContext CertGetCertificateChain CryptQueryObject

wldap32

ord73 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27

ws2_32

recvfrom sendto getpeername ioctlsocket gethostname getaddrinfo freeaddrinfo getsockopt send WSACreateEvent WSAEventSelect WSAEnumNetworkEvents socket WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup htons setsockopt WSACloseEvent __WSAFDIsSet select accept bind connect getsockname htonl listen recv WSAIoctl

Name

.text

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Start_0064.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

crypt32

wldap32

ws2_32

generic