Adjust[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Adjust.exe
Size

103.0MB
MD5

f1096758d3edfadfabe8285509c231d2
SHA1

62d5ef6a6e6b6508116c749d3590127d0dcdb9b2
SHA256

64bd633325c644c7e7903eaf44293054637b697176a7b5f3f50eda464f74684e
SHA512

54b6fc4ce9898a521b66ab10bc4e5ab695dd8654248a5e0c475eff02a61b1e9bc3fc37a761fef0e4cdfb48f481cf300845505da5390b140eaf425a1500d531e2
SSDEEP

786432:DQNUIXyknqL0GJ6ZiQSBmWzEsGvYX+4sGVxxUTQEJ2Eka7RluuZVkI4Pib:UNUIXpXGJsiJBmSuYX+47VOQE3BuC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Adjust.exe

Files

Adjust.exe
.exe windows:6 windows x64 arch:x64

987e7970a75db1c76ae967bf1e125cbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
GetUserNameW
OpenProcessToken
RegQueryInfoKeyA
GetFileSecurityW
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExA
MapGenericMask
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptGenKey
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
DuplicateTokenEx
CryptCreateHash
CryptDestroyHash
CryptSignHashA
CryptVerifySignatureA
AccessCheck
OpenThreadToken
RegEnumValueA
RegCloseKey

ws2_32

WSAGetLastError
gethostname
setsockopt
htons
htonl
getsockopt
closesocket
bind
ntohs
ntohl
send
__WSAFDIsSet
accept
ioctlsocket
WSASend
WSAEventSelect
WSAStartup
connect
recv
freeaddrinfo
getnameinfo
getsockname
listen
WSAAddressToStringA
shutdown
WSAEnumProtocolsW
WSARecv
WSASocketW
select
socket
WSACleanup
WSASetLastError
WSAIoctl
recvfrom
sendto
getaddrinfo

userenv

GetUserProfileDirectoryW

kernel32

FindNextFileW
GetDriveTypeW
GetFileAttributesW
GetFileAttributesExW
GetFinalPathNameByHandleW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
DeviceIoControl
GetHandleInformation
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetDiskFreeSpaceW
InitOnceExecuteOnce
GetTickCount64
GetModuleHandleW
SetFileCompletionNotificationModes
GetProcessTimes
GetFileTime
GetModuleHandleExW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WaitForMultipleObjects
TerminateProcess
GetExitCodeProcess
OpenProcess
CreatePipe
CreateProcessW
GetProcessId
GetConsoleWindow
GetFileType
PeekNamedPipe
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetSystemTimeAsFileTime
GetProcessAffinityMask
FindFirstFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
VerifyVersionInfoW
SetHandleInformation
VerSetConditionMask
GlobalFree
WideCharToMultiByte
GetOverlappedResult
FindClose
SetLastError
FormatMessageA
LocalFree
GetUserDefaultLCID
GetUserGeoID
GetGeoInfoA
GetLocaleInfoA
MultiByteToWideChar
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
WakeAllConditionVariable
WaitForSingleObject
DeleteFileW
CreateDirectoryW
FormatMessageW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetFileInformationByHandle
ReOpenFile
CreateFileMappingA
MapViewOfFile
UnlockFileEx
SetFilePointerEx
SetFileInformationByHandle
ReadFile
LockFileEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
SwitchToThread
SleepConditionVariableCS
Sleep
SetEvent
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetVersionExA
GetTempPathW
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetLastError
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
FlushFileBuffers
EnterCriticalSection
DuplicateHandle
CreateFileW
CreateFileMappingW
CreateEventA
CloseHandle
AddVectoredContinueHandler
GetFileSizeEx
DeleteCriticalSection

vcruntime140

__C_specific_handler
wcsrchr
__std_exception_copy
__current_exception
memmove
wcsstr
wcschr
memset
memcpy
_CxxThrowException
__std_exception_destroy
__current_exception_context
_local_unwind

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_c_exit
_cexit
_initialize_onexit_table
_register_onexit_function
abort
_crt_atexit
terminate
__p___argv
__p___argc
_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
_initterm_e
_configure_narrow_argv
exit
_initialize_narrow_environment
_get_initial_narrow_environment
_errno
_beginthreadex
_initterm

api-ms-win-crt-string-l1-1-0

_wcsdup
wcscmp
wcsncmp
strncpy
_strdup
iswctype
wcscat
wcscpy
strcat
strcpy
_wcsupr
towupper
strcmp
wcstok_s
wcsncat
wcslen
strlen
isdigit

api-ms-win-crt-environment-l1-1-0

_wgetcwd
_wgetenv
getenv
_wgetdcwd

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
realloc
_set_new_mode
calloc

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
fputs
__stdio_common_vfprintf
__stdio_common_vsprintf
fflush
_set_fmode
__p__commode
__acrt_iob_func
__stdio_common_vswscanf

api-ms-win-crt-filesystem-l1-1-0

_wfullpath
_wrename

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ncrypt

NCryptGetProperty
NCryptEncrypt
NCryptDecrypt
NCryptImportKey
NCryptExportKey
NCryptOpenStorageProvider
NCryptSignHash
NCryptVerifySignature
NCryptFreeObject
NCryptTranslateHandle

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenSystemStoreA
CertGetNameStringW
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertOpenStore

winhttp

WinHttpGetProxyForUrl
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser

secur32

CompleteAuthToken
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext

iphlpapi

GetIfEntry2
GetIfTable2
GetUnicastIpAddressTable
GetAnycastIpAddressTable
FreeMibTable
ConvertInterfaceNameToLuidW
ConvertInterfaceLuidToNameW
ConvertLengthToIpv4Mask
GetAdaptersAddresses

mswsock

TransmitFile

Exports

Exports

IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__f6667de81ba3372976bb88a1ffd53978a14e5062
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__d9d51255c13e1e63932724fc45c8d9d7d992f5cb
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__d04f70c150119a1a6df693cde53c8a58128d5e2b
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__e8b0041f4e89ff307dd3640c69c109d0d8139b8e
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1cff6a2f13f336178f12f2558128228775e047f6
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__e18826d035036aa5606c61e869f37df97fe5892f
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__7f4c88f0402ae949ca8b3e2b3a3e6235b49772f0
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__ba182be51e30552971cbbdb9960f52a7ebc17ff8__62fa6fcb73a0e0d2fda77bdbf26359facfbaa734
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__8349780683d23085ca6fca3423ec245733e16c32__3abce4986f080175b20b8a8b5e7458bfdda881e4
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__8fe7b7a26fde0b5d6373df2756c2f2545cfc5fed__2c881359d3c4c7f4c4da4479a1cee5896becfb6b
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__092e385b15f846acab22b8180eb675720c49e4f8
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
JNU_GetEnv
JNU_ThrowByName
JNU_ThrowNullPointerException
__svm_code_section
__svm_version_info
__svm_vm_java_version
__svm_vm_target_ccompiler
__svm_vm_target_libc
__svm_vm_target_libraries
__svm_vm_target_platform
__svm_vm_target_staticlibraries
graal_attach_thread
graal_create_isolate
graal_detach_all_threads_and_tear_down_isolate
graal_detach_thread
graal_get_current_thread
graal_get_isolate
graal_tear_down_isolate
jio_snprintf
main

Sections

.text
Size: 59.4MB - Virtual size: 59.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 43.0MB - Virtual size: 43.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 300KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

987e7970a75db1c76ae967bf1e125cbe

Headers

DLL Characteristics

File Characteristics

Imports

version

advapi32

ws2_32

userenv

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ncrypt

crypt32

winhttp

secur32

iphlpapi

mswsock

Exports

Exports

Sections

.text Size: 59.4MB - Virtual size: 59.4MB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 8KB - Virtual size: 5KB

.rodata Size: 40KB - Virtual size: 36KB

.svm_hea Size: 43.0MB - Virtual size: 43.0MB

.reloc Size: 300KB - Virtual size: 298KB

.rsrc Size: 188KB - Virtual size: 188KB

.text
Size: 59.4MB - Virtual size: 59.4MB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 8KB - Virtual size: 5KB

.rodata
Size: 40KB - Virtual size: 36KB

.svm_hea
Size: 43.0MB - Virtual size: 43.0MB

.reloc
Size: 300KB - Virtual size: 298KB

.rsrc
Size: 188KB - Virtual size: 188KB