Tulpical V3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Tulpical V3.exe
Size 532KB
Sample240613-wltzqa1fpl
SHA256 4d7450fe549dc086934356342d23c0b76cb4484e6c63a8ea57a8beb09a071962
MD5 5c2fc73e0503d1e5a0db84da002b04b5
SHA1 fe2478a0260402397d6530b769ac3a415c0a4a23
SHA512 9b82e58bd79aa90a22a4836c1a18a971db6737c596518772c709c91f956bd6e35fc536ee693e1a5b12f16063165c2e6f146719c7df9bbcd46948059c4fcda54d
SSDEEP 6144:p8KBhBStjv1GVCPuJrR8/wVo+9UtAHcix1UO+7FXbxE8MlQS3b2aKwR12y8oGXXs:pxTBSBspSbGat3S3lbbf8FhqBnAKsQH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tulpical V3.exe

File Explorer

Tulpical V3.exe

.exe 532KB

Tulpical V3.exe

IMPHASH c158c855cadf2d9996680c11a2efcbf1
SHA256 4d7450fe549dc086934356342d23c0b76cb4484e6c63a8ea57a8beb09a071962
MD5 5c2fc73e0503d1e5a0db84da002b04b5
SHA1 fe2478a0260402397d6530b769ac3a415c0a4a23
SHA512 9b82e58bd79aa90a22a4836c1a18a971db6737c596518772c709c91f956bd6e35fc536ee693e1a5b12f16063165c2e6f146719c7df9bbcd46948059c4fcda54d
SSDEEP 6144:p8KBhBStjv1GVCPuJrR8/wVo+9UtAHcix1UO+7FXbxE8MlQS3b2aKwR12y8oGXXs:pxTBSBspSbGat3S3lbbf8FhqBnAKsQH
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

406420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mquem\Desktop\Tulpical\Output\Tulpical V3.pdb

kernel32

GetConsoleWindow lstrcmpiA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter GetTickCount64 CreateFileA InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW CreateToolhelp32Snapshot ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree CreateFileW Process32First Sleep GetCurrentProcess CloseHandle LoadLibraryA GetCurrentProcessId GetProcAddress GetModuleHandleA LoadLibraryExA VirtualAlloc DeviceIoControl Process32Next VirtualFree AcquireSRWLockExclusive SetConsoleTitleA

user32

UpdateWindow RegisterClassExA PostQuitMessage UnregisterClassA PeekMessageA LoadIconA TranslateMessage GetKeyState DefWindowProcA MoveWindow FindWindowA SendInput GetCursorPos GetForegroundWindow GetAsyncKeyState GetMessageExtraInfo CreateWindowExA ReleaseCapture GetMonitorInfoA DispatchMessageA ScreenToClient SetLayeredWindowAttributes SetClipboardData GetClipboardData EmptyClipboard SetWindowDisplayAffinity SetWindowLongA ShowWindow GetSystemMetrics DestroyWindow GetWindowRect SetCursorPos MonitorFromWindow GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect OpenClipboard LoadCursorA CloseClipboard SetProcessDPIAware IsWindowUnicode

gdi32

CreateSolidBrush

advapi32

OpenProcessToken RegQueryValueExA RegCloseKey RegCreateKeyA LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyA RegDeleteKeyA RegSetValueExA RegOpenKeyExA

shell32

SHGetFolderPathW

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z

ntdll

NtQuerySystemInformation RtlAnsiStringToUnicodeString RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlInitAnsiString

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr strstr memchr memcpy __current_exception __current_exception_context _CxxThrowException memset __C_specific_handler memcmp memmove __std_terminate __std_exception_destroy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free realloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_initial_narrow_environment _initterm _initterm_e _exit _initialize_onexit_table __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback abort _beginthreadex _invalid_parameter_noinfo_noreturn exit system perror _errno _initialize_narrow_environment terminate

api-ms-win-crt-string-l1-1-0

strcmp tolower _stricmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __stdio_common_vsscanf _wfopen fseek ftell __stdio_common_vsprintf _get_stream_buffer_pointers _fseeki64 fread __p__commode ungetc setvbuf fgetpos fwrite __stdio_common_vfprintf fgetc fclose fflush __acrt_iob_func fputc fsetpos

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atof strtoull

api-ms-win-crt-math-l1-1-0

sinf sqrtf powf fmodf cosf ceilf acosf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale