6[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
6.exe
Size 3.3MB
Sample240704-swwdraycqp
SHA256 23d23d9bfe66cfcca000342ec36c54f6bbc138a5a50fc1a4f9de28dcf7be72bb
MD5 b294eaca8fd0644ad05b2d8c760baf8d
SHA1 9275529b6e9c5113d3c553bcd4a7340dbad55cd6
SHA512 c4ca9fb97815c2aa71974a287d2a4ba22b64dd82a3cdc2e8f8cbaf443c70e478ba39b35477f9d84883df8cc6cf5dfad0a2b17f39bedf5d37b0109c8fbcad96b3
SSDEEP 49152:d77LvQE87W0HWTKM4sUgFXSyTiYC7xgVjyK/Fj/m:NOpYC7SyK/Fi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6.exe

File Explorer

6.exe

.exe 3.3MB

6.exe

IMPHASH 8d8869df83df989ec7161764c2d5b700
SHA256 23d23d9bfe66cfcca000342ec36c54f6bbc138a5a50fc1a4f9de28dcf7be72bb
MD5 b294eaca8fd0644ad05b2d8c760baf8d
SHA1 9275529b6e9c5113d3c553bcd4a7340dbad55cd6
SHA512 c4ca9fb97815c2aa71974a287d2a4ba22b64dd82a3cdc2e8f8cbaf443c70e478ba39b35477f9d84883df8cc6cf5dfad0a2b17f39bedf5d37b0109c8fbcad96b3
SSDEEP 49152:d77LvQE87W0HWTKM4sUgFXSyTiYC7xgVjyK/Fj/m:NOpYC7SyK/Fi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

389692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExW RegSetValueExA RegCloseKey GetTokenInformation RegEnumKeyExW RegQueryValueExW EventWrite EventRegister EventEnabled OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptDecrypt BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptEncrypt

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader SetLastError CreateProcessA GetLastError GetConsoleWindow GetModuleHandleA GetProcAddress FreeConsole AllocConsole LocalFree ResumeThread CloseHandle GetCurrentProcessId CloseThreadpoolIo ExitProcess MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFullPathNameW GetLongPathNameW WideCharToMultiByte GetCPInfo LocalAlloc GetConsoleOutputCP RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo CopyFileExW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile SetEvent CreateEventExW FormatMessageW FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetEnvironmentVariableW GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoCreateGuid CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitializeEx CoWaitForMultipleHandles CoGetApartmentType

api-ms-win-crt-math-l1-1-0

modf pow ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv _seh_filter_exe _set_app_type abort _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

417KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic