Hgma[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Hgma.exe
Size

7.7MB
MD5

708761d425cd2aef9310b7cc4ffeb2f1
SHA1

1ae88e85c3bf0322534871c947d8b7f3a9f0781c
SHA256

629dbb764622643920b6108872300b11e1bd5a1b9882c2637cc9cdf0b0d00a26
SHA512

5840c8506a1c9b4733eda416274caba94541ae467ec25343fc8f567e234d2bac60e9b5bbe4ede3184add4d1d3a0a85ed6c240e60bcce4d4371e6835eb6481657
SSDEEP

196608:aQkv9s+RIZr8degtL8+R6+Nm4dPtQr2TXdV1H04j/UlGv0QTVwZaZFUr+ZLiyVFh:aQkvrRIGdegOWm4xtrdjzjU20gKk1/ge

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hgma.exe

Files

Hgma.exe
.exe windows:4 windows x86 arch:x86

f8e8f1885bbb2d39093979562d29b882

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmSetCompositionWindow
ImmGetContext
ImmGetCompositionWindow
ImmSetConversionStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetCompositionStringA
ImmGetConversionStatus

d3d8

Direct3DCreate8

ws2_32

send
gethostname
gethostbyname
shutdown
__WSAFDIsSet
htonl
ntohs
select
inet_ntoa
inet_addr
getsockname
getpeername
accept
closesocket
recvfrom
recv
sendto
WSAEnumNetworkEvents
connect
listen
WSAEventSelect
bind
socket
setsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAStartup
WSACleanup
WSAGetLastError
htons
WSASocketA
WSAIoctl
WSASetEvent
WSAStringToAddressA
WSACreateEvent
WSACloseEvent
WSAAddressToStringA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

timeGetTime

kernel32

LCMapStringW
LCMapStringA
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetFilePointer
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCPInfo
GetStringTypeW
CreateDirectoryA
CloseHandle
GetFileTime
CreateFileA
CompareFileTime
SetLastError
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineA
GlobalFree
GlobalUnlock
IsBadCodePtr
GlobalAlloc
GetModuleFileNameA
GetTickCount
CreateMutexA
CreateEventA
ReleaseMutex
WaitForSingleObject
HeapSize
WaitForMultipleObjects
SetThreadPriority
CreateThread
ResumeThread
TerminateThread
Sleep
ExitThread
lstrlenA
LocalFree
MultiByteToWideChar
LocalAlloc
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDriveTypeA
GetLogicalDriveStringsA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
InterlockedIncrement
InterlockedDecrement
DeleteFileA
ReadFile
GetTempFileNameA
GetTempPathA
WriteFile
LoadLibraryA
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
GetVersionExA
IsProcessorFeaturePresent
CompareStringA
HeapFree
ExitProcess
CompareStringW
SetFileAttributesA
SetStdHandle
SetEndOfFile
IsBadReadPtr
ResetEvent
GetOEMCP
SetEvent
lstrcpyA
GlobalLock
HeapAlloc
GetVersion
GetStartupInfoA
RaiseException
RtlUnwind
MoveFileA
DeleteCriticalSection
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
InitializeCriticalSection
ExpandEnvironmentStringsA
FindNextFileA
CreateProcessA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindClose
GetCurrentProcess
GetExitCodeProcess
SetEnvironmentVariableA
TerminateProcess
GetEnvironmentVariableA
GetWindowsDirectoryA
FlushFileBuffers
GetFileType
HeapReAlloc
GetFullPathNameA
GetACP
GetFileAttributesA
FormatMessageA
GetSystemTime
GetLocalTime
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
GetSystemTimeAsFileTime

user32

MessageBoxA
GetClientRect
DdeNameService
DdeCreateStringHandleA
GetWindowRect
GetSystemMetrics
SetWindowTextA
GetParent
GetCursorPos
GetClipCursor
ClipCursor
GetActiveWindow
SetCursorPos
GetAsyncKeyState
SetForegroundWindow
SendMessageA
SetWindowLongA
EnableWindow
SetActiveWindow
FindWindowA
IsCharAlphaA
GetFocus
CreateWindowExA
LoadIconA
RegisterClassA
FindWindowExA
SetTimer
WaitMessage
GetMessageA
DdeInitializeA
CreateAcceleratorTableA
DefWindowProcA
TranslateAcceleratorA
PostQuitMessage
PostMessageA
SetFocus
ShowWindow
DispatchMessageA
PeekMessageA
TranslateMessage
DdeQueryStringA
CharLowerA
CharUpperA
DdeClientTransaction
DdeGetData
DdeConnect
DdeFreeStringHandle
DdeDisconnect
DdeUninitialize
GetDesktopWindow
ShowCursor
IsWindow
DdeGetLastError
DdeCreateDataHandle
DdePostAdvise
DdeFreeDataHandle

comdlg32

GetOpenFileNameA

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyExA

dsound

ord11
ord2

binkw32

_BinkOpen@8
_BinkDoFrame@4
_BinkClose@4
_BinkWait@4
_BinkService@4
_BinkCopyToBuffer@28
_BinkSetSoundSystem@8
_BinkOpenDirectSound@4
_BinkNextFrame@4

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 480KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 288KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8e8f1885bbb2d39093979562d29b882

Headers

File Characteristics

Imports

imm32

d3d8

ws2_32

version

winmm

kernel32

user32

comdlg32

advapi32

dsound

binkw32

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.rdata Size: 480KB - Virtual size: 477KB

.data Size: 288KB - Virtual size: 418KB

.data1 Size: 4KB - Virtual size: 2KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 7.0MB - Virtual size: 7.0MB

.rdata
Size: 480KB - Virtual size: 477KB

.data
Size: 288KB - Virtual size: 418KB

.data1
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 20KB - Virtual size: 16KB