h20[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

h20.exe
Size

918KB
MD5

42aedfbe60926aac1464a62d8d1c4df6
SHA1

89b2cdb05a7ee068b3601311331f057b0364eedf
SHA256

412e058e92b2498a4dcc4bf70b9aeedc8361f97be0fc071662d5cc480fd965ae
SHA512

ec8a1962c37f06a8ebab527a492d30ace1fb38cfa56d2dfed20fdb79a28693a555e8c74834703e97218575319433b95ccbbff6ca1c1f01adfeec79447844e7ea
SSDEEP

24576:wtT0dc9f8XTEtvM6kvvJ+11u4CN5oHDsUBmT:PTovsc11sN5ojspT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h20.exe

Files

h20.exe
.exe windows:6 windows x64 arch:x64

f2531102fa40c55e6ccc64a53bc417cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpyA
GetLocalTime
GetModuleFileNameA
GetCommandLineA
CreateFileA
lstrlenA
GetCurrentProcess
WaitForSingleObject
GetWindowsDirectoryA
GetExitCodeProcess
CreateProcessA
SetFileAttributesA
DeviceIoControl
GetCurrentDirectoryA
GetVersion
GetEnvironmentVariableA
GetFullPathNameA
FreeLibrary
FormatMessageA
GetFileAttributesA
FindFirstFileA
FindClose
LoadLibraryA
LocalAlloc
FindNextFileA
LocalSize
LocalFree
DeleteFileA
GetModuleHandleW
lstrcmpiA
GetModuleFileNameW
GetFirmwareEnvironmentVariableA
WideCharToMultiByte
MultiByteToWideChar
GetSystemFirmwareTable
SetEnvironmentVariableA
CreateFileW
OutputDebugStringW
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleA
SetConsoleTextAttribute
SetConsoleCursorPosition
SetConsoleTitleA
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetLastError
GetStdHandle
LoadLibraryExW
ReadConsoleW
DeleteFileW
Sleep
CloseHandle
MoveFileExW
GetFileAttributesExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetTimeZoneInformation
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
GetFileType
SetEndOfFile
GetCurrentThreadId
GetOEMCP
GetACP
IsValidCodePage
GetProcessHeap
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeW
HeapFree
RtlPcToFileHeader
HeapAlloc
GetSystemTimeAsFileTime
AreFileApisANSI
ReadFile
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue

user32

wsprintfA
CharNextA
ExitWindowsEx

advapi32

LookupPrivilegeValueA
RegCreateKeyExA
RegSetValueExA
AdjustTokenPrivileges
RegOpenKeyExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA

ole32

CoCreateGuid

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

setupapi

SetupDiGetINFClassA
SetupDiGetDeviceInfoListDetailA
SetupDiGetDeviceRegistryPropertyA
SetupOpenInfFileA
SetupDiGetDeviceInstallParamsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInfoA
SetupDiCreateDeviceInfoA
SetupDiCreateDeviceInfoListExA
SetupCloseInfFile
CM_Get_Device_ID_ExA
SetupDiCallClassInstaller
SetupDiGetClassDevsExA
SetupDiSetClassInstallParamsA
SetupDiSetDeviceRegistryPropertyA
SetupFindFirstLineA
SetupGetStringFieldA
SetupDiCreateDeviceInfoList

shlwapi

PathFileExistsA

Sections

.text
Size: 677KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2531102fa40c55e6ccc64a53bc417cc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

iphlpapi

version

setupapi

shlwapi

Sections

.text Size: 677KB - Virtual size: 676KB

.rdata Size: 193KB - Virtual size: 192KB

.data Size: 12KB - Virtual size: 24KB

.pdata Size: 31KB - Virtual size: 31KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 677KB - Virtual size: 676KB

.rdata
Size: 193KB - Virtual size: 192KB

.data
Size: 12KB - Virtual size: 24KB

.pdata
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 3KB - Virtual size: 3KB