notepad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
notepad.exe
Size 352KB
Sample240613-b4f6cszclc
SHA256 ca29e8d8eca84f6f1b39e0bad771752cebf86d7754c20b69c77ab641a9ac2767
MD5 ff3e29fdfafa0e9030e2fcd71489d41d
SHA1 d11d30ad4f2780ffee3626901bc50ccf5b20fc2d
SHA512 288d372144727125fcf5878534da5509c5a192e49c9da12cc6491d29ef3eb833394b9115d2da33a1b98fd776714df0296f21c7e64c6b05c2de3db6d060418815
SSDEEP 6144:fn4F8DgewfvNtgmk2RJZtqJpiNecjqvLeYFu5CdUqiilipQ5gfzDVlVXgJ:fn4F8Dgewfltgmk2RP4Ls5CdUcAQ5GpX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notepad.exe

File Explorer

notepad.exe

.exe 352KB

notepad.exe

IMPHASH 0e6bccf88f4251909d1746dba78cba57
SHA256 ca29e8d8eca84f6f1b39e0bad771752cebf86d7754c20b69c77ab641a9ac2767
MD5 ff3e29fdfafa0e9030e2fcd71489d41d
SHA1 d11d30ad4f2780ffee3626901bc50ccf5b20fc2d
SHA512 288d372144727125fcf5878534da5509c5a192e49c9da12cc6491d29ef3eb833394b9115d2da33a1b98fd776714df0296f21c7e64c6b05c2de3db6d060418815
SSDEEP 6144:fn4F8DgewfvNtgmk2RJZtqJpiNecjqvLeYFu5CdUqiilipQ5gfzDVlVXgJ:fn4F8Dgewfltgmk2RP4Ls5CdUcAQ5GpX
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notepad.pdb

gdi32

SetMapMode SetViewportExtEx SetWindowExtEx LPtoDP SetBkMode GetTextMetricsW TextOutW AbortDoc EndDoc SetAbortProc StartDocW StartPage CreateDCW EnumFontsW GetTextFaceW GetDeviceCaps DeleteDC DeleteObject SetBkColor CreateSolidBrush GetTextExtentPoint32W SelectObject CreateCompatibleDC EndPage CreateFontIndirectW

user32

PostQuitMessage BeginPaint EndPaint FillRect DrawTextW DrawFocusRect DefWindowProcW TrackMouseEvent InvalidateRect DestroyIcon SetThreadDpiAwarenessContext DialogBoxParamW LoadIconW GetFocus MessageBoxW ShowWindow SetCursor SetActiveWindow EnableMenuItem IsIconic SetFocus MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW GetMenu GetSubMenu OpenClipboard IsClipboardFormatAvailable CloseClipboard CheckMenuItem SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW MonitorFromWindow RegisterWindowMessageW LoadCursorW LoadImageW RegisterClassExW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW IsWindow CreateDialogIndirectParamW GetPropW SetPropW GetDlgItem RemovePropW CheckDlgButton CheckRadioButton IsDlgButtonChecked NotifyWinEvent CreateWindowExW GetWindowTextLengthW GetClientRect DestroyWindow GetDpiForWindow SystemParametersInfoForDpi SendMessageW MoveWindow GetDC LoadStringW PostMessageW ReleaseDC

api-ms-win-crt-string-l1-1-0

wcscmp wcsnlen memset

api-ms-win-crt-runtime-l1-1-0

_c_exit _initterm_e _initterm _register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate __CxxFrameHandler3 __current_exception __current_exception_context _CxxThrowException _o__crt_atexit _o___stdio_common_vswprintf _o__configure_wide_argv _o___std_exception_destroy _o___std_exception_copy _o__configthreadlocale _o___p__commode _o__exit _o__cexit _o__callnewh _o__beginthreadex _o__errno wcsrchr wcschr __C_specific_handler memcmp memcpy memmove

api-ms-win-core-libraryloader-l1-2-0

LockResource GetModuleHandleExW FindResourceExW LoadResource GetModuleHandleA GetModuleFileNameA FreeLibrary GetProcAddress GetModuleHandleW GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject ReleaseSemaphore ReleaseSRWLockExclusive EnterCriticalSection SetEvent CreateEventExW AcquireSRWLockExclusive ReleaseMutex WaitForSingleObjectEx DeleteCriticalSection AcquireSRWLockShared CreateMutexExW OpenSemaphoreW ReleaseSRWLockShared CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapSetInformation HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException GetLastError SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess OpenProcessToken CreateProcessW TerminateProcess GetCurrentThreadId GetStartupInfoW GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW FindNLSString GetLocaleInfoW GetACP

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoCreateInstance CoInitializeEx PropVariantClear CoUninitialize CoWaitForMultipleHandles CoCreateGuid CoTaskMemAlloc CoCreateFreeThreadedMarshaler

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW PathIsFileSpecW PathFileExistsW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateString WindowsCreateStringReference WindowsGetStringRawBuffer

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegGetValueW RegSetValueExW RegEnumValueW RegQueryInfoKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegDeleteKeyExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-heap-l2-1-0

LocalUnlock LocalFree LocalLock GlobalAlloc GlobalFree LocalAlloc LocalReAlloc

api-ms-win-core-file-l1-1-0

DeleteFileW GetFileAttributesW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle FindClose FindFirstFileW CreateFileW ReadFile GetDiskFreeSpaceExW GetFullPathNameW CreateDirectoryW WriteFile

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetCommandLineW SetCurrentDirectoryW

api-ms-win-core-string-l1-1-0

FoldStringW WideCharToMultiByte CompareStringOrdinal MultiByteToWideChar

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-core-memory-l1-1-0

MapViewOfFile CreateFileMappingW UnmapViewOfFile

api-ms-win-core-registry-l2-1-0

RegCreateKeyW

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize GlobalLock GlobalUnlock

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-eventing-provider-l1-1-0

EventRegister EventUnregister EventWriteTransfer EventSetInformation

api-ms-win-base-util-l1-1-0

IsTextUnicode

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent GetProcessMitigationPolicy

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

comctl32

ImageList_Create ImageList_SetBkColor ord381 ImageList_ReplaceIcon ord410 ImageList_Draw ImageList_GetIconSize ord413 ImageList_Destroy ord345 CreateStatusWindowW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

notepad.exe

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-shcore-path-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-eventing-provider-l1-1-0

api-ms-win-base-util-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

comctl32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic