DB0F27CA4C6[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DB0F27CA4C6.exe
Size 22.3MB
Sample240603-whxansfe22
SHA256 919d2bfdfbe14574e916e38f612dd832ff088fa9d26b9a4a80d6b06f1d338e73
MD5 79e3b78ce73ccc0031e43b22abef4de8
SHA1 4b6535be36d544c9c7b20c41aaec708583a09054
SHA512 24a6b33f9a2ba07bb3ee3c3f4e68dea25f56b49e03c31c5f7d4d5d27da5f0b2ef040bb896090251492ee83c8bd711928e9e7c7d9f8db3593a5b0d5cbdb475e4e
SSDEEP 393216:0pUcQ5zzPiYfcLYnzjbLYg/GXv2pXpH9P3il/gsHoEl8h/lt8/QHpQm:6QpKYf+CLHGm9PggsHzylt8if
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DB0F27CA4C6.exe

File Explorer

DB0F27CA4C6.exe

.exe 22.3MB

DB0F27CA4C6.exe

IMPHASH 269a3a5a5bc0f5bc811506f5d078dc89
SHA256 919d2bfdfbe14574e916e38f612dd832ff088fa9d26b9a4a80d6b06f1d338e73
MD5 79e3b78ce73ccc0031e43b22abef4de8
SHA1 4b6535be36d544c9c7b20c41aaec708583a09054
SHA512 24a6b33f9a2ba07bb3ee3c3f4e68dea25f56b49e03c31c5f7d4d5d27da5f0b2ef040bb896090251492ee83c8bd711928e9e7c7d9f8db3593a5b0d5cbdb475e4e
SSDEEP 393216:0pUcQ5zzPiYfcLYnzjbLYg/GXv2pXpH9P3il/gsHoEl8h/lt8/QHpQm:6QpKYf+CLHGm9PggsHzylt8if
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1120140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\LWAY\Desktop\lawyS\x64\Release\FreeLway.pdb

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind NtSetInformationThread VerSetConditionMask

setupapi

SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

K32EnumProcessModules DebugBreak LocalAlloc lstrcmpA CreateFileA GetCurrentThread WaitForSingleObject CreateProcessA ReadFile Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot OpenThread GetFileAttributesA GetSystemInfo ReadProcessMemory VirtualQuery LeaveCriticalSection FormatMessageA GetFileSizeEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead K32EnumProcesses InitOnceComplete InitOnceBeginInitialize OutputDebugStringW QueryFullProcessImageNameW GetModuleHandleW SleepEx GetSystemDirectoryA GetCurrentThreadId DeleteCriticalSection CloseHandle GetLastError Sleep UnmapViewOfFile CreateFileW InitializeCriticalSectionEx GetCurrentProcess VirtualProtect GetModuleFileNameA GlobalUnlock WideCharToMultiByte GlobalLock LocalFree OpenProcess GetCurrentProcessId GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress GetConsoleWindow Beep QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx K32GetModuleFileNameExW GetTickCount64 MapViewOfFile CreateFileMappingW GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError EnterCriticalSection

user32

CreateWindowExA PeekMessageA DefWindowProcA FindWindowExA PostMessageA UnregisterClassA GetWindowLongA EnumWindows IsWindowVisible GetWindowThreadProcessId FindWindowA DispatchMessageA TranslateMessage GetWindowRect ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetLayeredWindowAttributes UpdateWindow RegisterClassExA DestroyWindow PostQuitMessage GetSystemMetrics ShowWindow GetAsyncKeyState SetCursorPos MoveWindow GetCursorPos

advapi32

CryptEncrypt CryptReleaseContext RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegGetValueA RegCloseKey CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData RegQueryValueExA RegSetValueExW CryptDestroyHash CryptDestroyKey CryptImportKey RegCreateKeyExW OpenServiceA QueryServiceStatusEx OpenProcessToken OpenSCManagerA CryptAcquireContextA LookupPrivilegeValueA CloseServiceHandle RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges

shell32

SHGetFolderPathW ShellExecuteA

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ _Mtx_destroy_in_situ _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CryptDecodeObjectEx CertAddCertificateContextToStore PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertFindExtension CertOpenStore CertGetNameStringW CertCloseStore CertEnumCertificatesInStore CertGetCertificateChain

ws2_32

WSAGetLastError getpeername bind connect getsockname gethostname inet_ntoa getsockopt htons ntohl sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet WSAStartup gethostbyname ntohs ioctlsocket listen htonl accept recv WSACleanup WSAIoctl WSASetLastError closesocket socket setsockopt send

shlwapi

PathRemoveFileSpecA StrStrW

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

iphlpapi

GetIfEntry GetIpForwardTable

winmm

PlaySoundA

mpr

WNetGetProviderNameA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler memchr __current_exception_context memcmp memmove __std_terminate __std_exception_destroy __std_exception_copy strstr wcsstr memcpy memset strchr strrchr _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fwrite _wfopen fclose __stdio_common_vsprintf fflush fread __stdio_common_vsscanf __acrt_iob_func _lseeki64 _open _close _pclose _write feof fputs fopen _read getchar fgets ftell fgetws _wpopen __stdio_common_vsprintf_s _popen __stdio_common_vfwprintf fputc _get_stream_buffer_pointers _fseeki64 fsetpos ungetc __p__commode setvbuf fgetpos _set_fmode fseek fgetc

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-string-l1-1-0

_strdup strncpy_s strncpy isupper tolower isspace toupper strpbrk strspn strncmp strcmp strcspn

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free calloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _beginthreadex _errno abort strerror _cexit exit _invalid_parameter_noinfo_noreturn _crt_atexit _getpid __sys_nerr _register_onexit_function _get_initial_narrow_environment _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtoull strtoll atoi strtod wcstombs_s

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file rename _fstat64 _stat64 _access _unlink

api-ms-win-crt-math-l1-1-0

sinf pow fmodf sqrtf _dclass acosf ceilf cosf __setusermatherr