santo[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

santo.exe
Size

2.1MB
MD5

aa2bce0134898904b17e69ede774ee59
SHA1

97ce3160046963d2474d9f973716e391b11a8072
SHA256

d0a79262d3488deecca0383af6aa0d4c5565f913e226b8b9061daedc7aab8bdf
SHA512

cf5f9fb14f279be750ab42f740c7a21886b8ee9e0d4a454f52b73efc913abb9f037f83383de0ae782518ef0ee057dbe3b965734094b0f4244149828e3809509e
SSDEEP

49152:ZAS9vKP097b7b7bjpYZAt2qP0giXGnUuZHRKttY+z+cPOL1dChhQcmYD:hv+AkqdZxKttYNcPOL1YhF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
santo.exe

Files

santo.exe
.exe windows:6 windows x64 arch:x64

Password: ff

0edfe6df66fa1956784d80212737fc9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\14382\Downloads\user\santo\build\santo.pdb

Imports

ws2_32

WSAStartup
WSACleanup

winmm

PlaySoundA

kernel32

GetStdHandle
SetCurrentConsoleFontEx
CreateFileW
GetModuleHandleA
Sleep
CloseHandle
GetConsoleWindow
VirtualFree
DeviceIoControl
VirtualAlloc
LoadLibraryExA
GetProcAddress
GetCurrentProcessId
LoadLibraryA
GetCurrentProcess
Process32First
CreateToolhelp32Snapshot
CreateFileA
Process32Next
lstrcmpiA
TerminateThread
MultiByteToWideChar
GetSystemTimeAsFileTime
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetTickCount
GetLocaleInfoA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetFileSizeEx
ReadFile
HeapFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
LocalFree
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
ReleaseSRWLockExclusive
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
InitializeSListHead
HeapAlloc
GlobalAlloc
FormatMessageA

user32

GetWindowRect
MessageBoxA
MoveWindow
FindWindowA
DispatchMessageA
DestroyWindow
GetSystemMetrics
ShowWindow
SetWindowLongA
SetWindowDisplayAffinity
GetMonitorInfoA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
SendInput
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetKeyState
GetMessageExtraInfo
LoadCursorA
MonitorFromWindow
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
SetCursor
GetClientRect
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetForegroundWindow
ScreenToClient
GetCursorPos
GetAsyncKeyState

gdi32

GetPixel
CreateSolidBrush

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

shell32

ShellExecuteA
SHGetFolderPathW

libssl-3-x64

OPENSSL_init_ssl

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Thrd_detach
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Mtx_lock
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Winerror_map@std@@YAHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??Bid@locale@std@@QEAA_KXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_Xtime_get_ticks
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Mtx_unlock
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlVirtualUnwind

dbghelp

ImageNtHeader
ImageDirectoryEntryToData
ImageRvaToVa

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
__std_exception_copy
__std_exception_destroy
strstr
__C_specific_handler
strchr
strrchr
longjmp
memcpy
memmove
memset
memchr
memcmp
__current_exception
__current_exception_context
__intrinsic_setjmp
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgetc
fputc
fread
feof
_lseek
fwrite
_fileno
_open
fgets
_write
_close
_setmode
__stdio_common_vfprintf
fseek
_wfopen
__stdio_common_vsscanf
_read
__stdio_common_vsprintf_s
clearerr
fclose
fflush
__acrt_iob_func
fopen
ferror
__stdio_common_vsnprintf_s
ftell
__p__commode
_get_stream_buffer_pointers
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_cexit
_crt_atexit
exit
_register_onexit_function
__p___argv
__p___argc
_exit
_initialize_onexit_table
_initialize_narrow_environment
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
_initterm_e
_configure_narrow_argv
perror
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
abort
_errno
_beginthreadex
terminate
_initterm

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
realloc
malloc

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-string-l1-1-0

strncpy
strcmp
tolower
wcscpy_s
strncmp
_stricmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_mkdir
_lock_file

api-ms-win-crt-time-l1-1-0

strftime
_localtime64
_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

strtoull
atof
strtol
strtoll
strtod

api-ms-win-crt-math-l1-1-0

__setusermatherr
sin
powf
fminf
sinf
acosf
_dsign
fmodf
fmod
sqrtf
atan2f
ceilf
cos
cosf

api-ms-win-crt-locale-l1-1-0

localeconv
___lc_codepage_func
_configthreadlocale

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 968KB - Virtual size: 968KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 852KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: ff

0edfe6df66fa1956784d80212737fc9f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

libssl-3-x64

msvcp140

ntdll

dbghelp

d3d11

imm32

d3dcompiler_43

dwmapi

d3dx11_43

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 968KB - Virtual size: 968KB

.rdata Size: 273KB - Virtual size: 273KB

.data Size: 852KB - Virtual size: 860KB

.pdata Size: 36KB - Virtual size: 36KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 968KB - Virtual size: 968KB

.rdata
Size: 273KB - Virtual size: 273KB

.data
Size: 852KB - Virtual size: 860KB

.pdata
Size: 36KB - Virtual size: 36KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 4KB - Virtual size: 4KB