client[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

client.exe
Size

1.7MB
MD5

e7e77ded24f3f16c4512270c713d2b2c
SHA1

60519a7f138d3a5d01683c6f3011b0bd1effa362
SHA256

224b80839fe23d6494fdc3378226dd691b9032149ff050d4b132711652a3d2a4
SHA512

e454aa65e5997d006f7ba2a80dde56ef1654dd57ccf84a505b031f1b53cb98217fb43df9e59b9db6a70da3550e31c626fb4f3718791a57fe419d3e4d3d5ff2a6
SSDEEP

24576:A99ZdfB5OgG7zcPXOpmqZZLGxLVasVHVDi3A0I3Nrg9JGFi7N/0rid/6v:SOgnGQT9IRC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

Files

client.exe
.exe windows:4 windows x86 arch:x86

c765ffc978c85546b4d185656f74e16b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
SetFilePointer
GetCurrentThread
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
GetLastError
CreateProcessA
FlushViewOfFile
GetCurrentProcessId
GetVersion
OpenFileMappingA
GetACP
IsDBCSLeadByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetExitCodeProcess
GetFileAttributesA
GetOEMCP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
ReadFile
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentDirectoryA
GetFullPathNameA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
SetUnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
TlsGetValue
SetLastError
TlsAlloc
GetCurrentThreadId
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetSystemTimeAsFileTime
ExitThread
TlsSetValue
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
CreateDirectoryA
GetLocalTime
RaiseException
HeapAlloc
HeapFree
RtlUnwind
WriteFile
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetTickCount
GetSystemTime
SystemTimeToFileTime
TerminateProcess
OpenMutexA
GetProfileStringA
GetSystemInfo
GetTimeZoneInformation
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceA
ExitProcess
InterlockedIncrement
InterlockedDecrement
CreateThread
SetThreadPriority
ResumeThread
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalMemoryStatus
OutputDebugStringA
InterlockedExchange
FreeEnvironmentStringsW
Sleep

user32

GetFocus
SetCapture
ReleaseCapture
GetActiveWindow
SetMenu
AdjustWindowRectEx
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClassW
CreateWindowExW
GetWindowDC
SetWindowTextW
BeginPaint
MessageBoxA
DestroyMenu
SystemParametersInfoA
GetDoubleClickTime
GetSystemMetrics
EndPaint
GetWindowRect
GetMessageA
GetKeyNameTextA
GetDC
ShowWindow
IsZoomed
GetKeyState
GetAsyncKeyState
DefWindowProcA
DefWindowProcW
IsWindowUnicode
PeekMessageA
TrackPopupMenu
ShowCursor
GetCursorPos
AppendMenuA
CreatePopupMenu
ReleaseDC
GetDesktopWindow
SetFocus
MapVirtualKeyA
ScreenToClient
FindWindowA
RegisterClassA
UpdateWindow
CreateWindowExA
LoadCursorA
LoadMenuA
SetCursor
SetWindowPos
ClientToScreen
SendMessageA
GetClientRect
GetWindowPlacement
CheckMenuItem
GetMenu
InvalidateRect
PostQuitMessage
GetWindowLongA
SetWindowLongA
LoadIconA
TranslateMessage
TranslateAcceleratorA
DispatchMessageA
LoadAcceleratorsA
SetWindowTextA

gdi32

CreateDIBSection
RealizePalette
BitBlt
DeleteObject
GetDeviceCaps
DeleteDC
SelectObject
SelectPalette
CreatePalette
CreateCompatibleDC

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

wsock32

ntohl
sendto
recvfrom
bind
ntohs
select
__WSAFDIsSet
recv
WSAGetLastError
htonl
htons
socket
connect
send
setsockopt
inet_ntoa
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname

comctl32

ord17

ddraw

DirectDrawCreate

dsound

ord1

winmm

midiOutGetDevCapsA
mmioSeek
timeSetEvent
timeKillEvent
mciSendCommandA
midiOutSetVolume
midiOutGetVolume
mmioClose
mmioOpenA
mmioSetBuffer
mmioRead

igrping

?SendPingMessage@@YA_NPADH00H@Z

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 8.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UVA_DATA
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LBMPEG_D
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c765ffc978c85546b4d185656f74e16b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wsock32

comctl32

ddraw

dsound

winmm

igrping

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 172KB - Virtual size: 168KB

.data Size: 332KB - Virtual size: 8.6MB

UVA_DATA Size: 16KB - Virtual size: 15KB

LBMPEG_D Size: 4KB - Virtual size: 1024B

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 172KB - Virtual size: 168KB

.data
Size: 332KB - Virtual size: 8.6MB

UVA_DATA
Size: 16KB - Virtual size: 15KB

LBMPEG_D
Size: 4KB - Virtual size: 1024B

.rsrc
Size: 4KB - Virtual size: 3KB