MetaTrader5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MetaTrader5.exe
Size 4.5MB
Sample240618-rdpyks1ckk
SHA256 0b502d9c21d2bed10365e82b1c85866360c215f61c7ea3b8ed4f5c34a18c656e
MD5 16b587e4063eabc4d83f7a3ce31baecf
SHA1 d69a8ab6d9d6251d369f8b55a0d08d46898d2bd3
SHA512 e4b88f903d20c80218096fd5f0a8bfa89c33237ab4560ccfd991dc66d494fc302776b31c432ca378800483f908fb40d625d5f1b1913dfa874fb15d4a94f6e1f2
SSDEEP 98304:mdazGfM/twmsx6lbZTS/rtAvGUQU3PSM7Srdn8eemAEIxo:Q0GCtUAbrP7SrV8JEn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

MetaTrader5.exe

.exe 4.5MB

MetaTrader5.exe

IMPHASH 8579eaa41882fd48e27575866daf2b2d
SHA256 0b502d9c21d2bed10365e82b1c85866360c215f61c7ea3b8ed4f5c34a18c656e
MD5 16b587e4063eabc4d83f7a3ce31baecf
SHA1 d69a8ab6d9d6251d369f8b55a0d08d46898d2bd3
SHA512 e4b88f903d20c80218096fd5f0a8bfa89c33237ab4560ccfd991dc66d494fc302776b31c432ca378800483f908fb40d625d5f1b1913dfa874fb15d4a94f6e1f2
SSDEEP 98304:mdazGfM/twmsx6lbZTS/rtAvGUQU3PSM7Srdn8eemAEIxo:Q0GCtUAbrP7SrV8JEn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

17:71:ac:ac:03:40:8d:5a:ee:46:0d:16:13:31:16:c8:05:d1:45:ff:a9:b9:78:28:ce:ef:92:5a:8b:e3:bd:40

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Jun 13, 2024

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

Major OS version

Entry point

1380877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb

kernel32

WriteFile SystemTimeToFileTime GetSystemTime SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW ReadConsoleA RemoveDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc VerifyVersionInfoW SetStdHandle SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapAlloc HeapFree HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime GetFullPathNameW GetFileType ExitProcess InterlockedPushEntrySList RtlUnwind GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource SetLastError LockResource LoadResource GetModuleFileNameW OpenProcess GetExitCodeProcess GetCurrentProcess GetTimeZoneInformation DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress Sleep GetCurrentThreadId DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA LeaveCriticalSection EnterCriticalSection GetLastError WaitForSingleObjectEx GetCPInfo ProcessIdToSessionId GetCurrentProcessId DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock OpenEventA SetEvent SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask SetErrorMode CloseHandle RemoveDirectoryA GetFileAttributesA MultiByteToWideChar OutputDebugStringA PeekNamedPipe GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileW GetDateFormatW GetTimeFormatW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObject CreateEventA QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation TerminateProcess GlobalMemoryStatusEx VirtualAlloc IsDebuggerPresent GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority TerminateThread GetExitCodeThread SuspendThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadAffinityMask SetEnvironmentVariableW SetCurrentDirectoryW OutputDebugStringW CreateProcessW GetSystemInfo

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId GetUserObjectInformationW ReleaseDC IsWindowVisible GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongW SetWindowLongW GetWindowLongW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow SetTimer MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA EnumWindows ShowWindow

gdi32

RemoveFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ReportEventW RegOpenKeyExA RegCreateKeyExA RegCloseKey

shell32

SHGetKnownFolderPath SHGetFileInfoW CommandLineToArgvW ord680

ole32

CoTaskMemFree

oleaut32

VariantClear

comctl32

InitCommonControlsEx

psapi

GetModuleInformation GetModuleFileNameExW GetProcessMemoryInfo

version

VerQueryValueW

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

MetaTrader5.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic