huzuni[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

huzuni.exe
Size

26.5MB
MD5

220903664f8a2859d31dcf742a8993ae
SHA1

52b2d3c2faceddb247cfb9163f025d299098580c
SHA256

b14d6309baddbd1ba7223a4a745881b0c357cd6f2314fb12788127f5f6930447
SHA512

66c3ca25a0dfcae9c97c513dfd2fb9af909b470d08e9f02852fe326576d3a74bcb59f4fd80aee328220c131791091fee6bcddbee3b7244956269ab39418cda75
SSDEEP

786432:v383NzinuQI5Sagkl8fohREOuagTRL7aTlh8ek:vON+sjXoohKjRL7aTlh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
huzuni.exe

Files

huzuni.exe
.exe windows:6 windows x64 arch:x64

17ceb3a8b92d6746ca9e9388a8923e88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

WideCharToMultiByte
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetClipboardData

advapi32

CryptDestroyKey

safeguard

?authenticateUser@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@XZ

imm32

ImmReleaseContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

normaliz

IdnToAscii

wldap32

ord211

crypt32

CertFindCertificateInStore

ws2_32

gethostname

shlwapi

PathFindFileNameW

rpcrt4

UuidCreate

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_wassert

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf

shell32

ShellExecuteA

Sections

^s]%N:0I
Size: - Virtual size: 813KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Dx*9':i<
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

I2\zhUH/
Size: - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

\#1vDy](
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

2'cJWDJ7
Size: - Virtual size: 17.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

EDX3YH1[
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sIQbads@
Size: 26.5MB - Virtual size: 26.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

b\uOpgeD
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17ceb3a8b92d6746ca9e9388a8923e88

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

kernel32

user32

advapi32

safeguard

imm32

msvcp140

dwmapi

d3dx11_43

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

shell32

Sections

^s]%N:0I Size: - Virtual size: 813KB

Dx*9':i< Size: - Virtual size: 196KB

I2\zhUH/ Size: - Virtual size: 552KB

\#1vDy]( Size: - Virtual size: 30KB

2'cJWDJ7 Size: - Virtual size: 17.5MB

EDX3YH1[ Size: 10KB - Virtual size: 10KB

sIQbads@ Size: 26.5MB - Virtual size: 26.5MB

b\uOpgeD Size: 512B - Virtual size: 480B

^s]%N:0I
Size: - Virtual size: 813KB

Dx*9':i<
Size: - Virtual size: 196KB

I2\zhUH/
Size: - Virtual size: 552KB

\#1vDy](
Size: - Virtual size: 30KB

2'cJWDJ7
Size: - Virtual size: 17.5MB

EDX3YH1[
Size: 10KB - Virtual size: 10KB

sIQbads@
Size: 26.5MB - Virtual size: 26.5MB

b\uOpgeD
Size: 512B - Virtual size: 480B