666[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
666.exe
Size 4.0MB
Sample240603-sxt73sah5v
SHA256 4958c554787a589449e918fc5e3acc61b0ca61fdbf7ce0b658d4f60e2052f48e
MD5 fb06afbe05e9006fb0974b34db9b3e47
SHA1 798adfdf387a81d4e4784508b1c7a45c2574e5fb
SHA512 5a7d0ae0e43cce249f4a8bd1239697a36b6f903336b23dd0b9c7aec415e0209dd24385e4f90d14a911208214415625f4a90ac490c1439f48be34cabde1c89080
SSDEEP 49152:zO24L/Por4CZ8BSnxlGWJzV89A6E2Lfv/jMuxB4sbD3IqSq+3:zDIMdD89aSlxBx3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
666.exe

File Explorer

666.exe

.exe 4.0MB

666.exe

IMPHASH 55f123c401799575d1d5e0892f10ae6b
SHA256 4958c554787a589449e918fc5e3acc61b0ca61fdbf7ce0b658d4f60e2052f48e
MD5 fb06afbe05e9006fb0974b34db9b3e47
SHA1 798adfdf387a81d4e4784508b1c7a45c2574e5fb
SHA512 5a7d0ae0e43cce249f4a8bd1239697a36b6f903336b23dd0b9c7aec415e0209dd24385e4f90d14a911208214415625f4a90ac490c1439f48be34cabde1c89080
SSDEEP 49152:zO24L/Por4CZ8BSnxlGWJzV89A6E2Lfv/jMuxB4sbD3IqSq+3:zDIMdD89aSlxBx3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

GetStdHandle GetConsoleMode TlsGetValue GetLastError SetLastError RaiseException ExitProcess GetStartupInfoA GetCommandLineW GetCurrentProcessId GetCurrentThreadId GetCurrentProcess ReadProcessMemory GetModuleFileNameW GetModuleHandleA WriteFile ReadFile CloseHandle SetFilePointer SetEndOfFile GetSystemInfo LoadLibraryW LoadLibraryA GetProcAddress FreeLibrary FormatMessageW GetFileType CreateFileW GetFileAttributesW GetCurrentDirectoryW GetFullPathNameW GetConsoleOutputCP GetOEMCP GetProcessHeap HeapAlloc HeapFree TlsAlloc TlsSetValue CreateThread ExitThread LocalAlloc LocalFree Sleep SuspendThread ResumeThread TerminateThread WaitForSingleObject SetThreadPriority GetThreadPriority GetCurrentThread OpenThread IsDebuggerPresent CreateEventA ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP RtlUnwind EnumResourceTypesA EnumResourceNamesA EnumResourceLanguagesA FindResourceA FindResourceExA LoadResource SizeofResource LockResource FreeResource GetWindowsDirectoryA DeleteFileA GetVersionExA CompareStringA GetLocaleInfoA GetDateFormatA EnumCalendarInfoA SetFileAttributesW CompareStringW GetLocaleInfoW GetDateFormatW FindFirstFileExW VirtualFree OpenProcess TerminateProcess DeviceIoControl FindClose GetLocalTime GetCPInfo GetThreadLocale SetThreadLocale GetUserDefaultLCID CreateToolhelp32Snapshot Process32First Process32Next

user32

BlockInput MessageBoxA CharUpperBuffW CharLowerBuffW CharUpperA CharUpperBuffA CharLowerA CharLowerBuffA SystemParametersInfoA GetSystemMetrics MessageBeep

oleaut32

SysAllocStringLen SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement SafeArrayPutElement SafeArrayPtrOfIndex VariantChangeTypeEx VariantClear VariantCopy VariantInit

advapi32

LookupPrivilegeValueA RegSetValueA InitiateSystemShutdownA RegSetValueExW RegCreateKeyExW RegOpenKeyExW OpenProcessToken AdjustTokenPrivileges RegCloseKey RegFlushKey

shell32

SHGetFolderPathA

Name

.text

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

666.exe

kernel32

user32

oleaut32

advapi32

shell32

generic