samki[.]exe | Triage

Resubmissions

21/07/2024, 23:48

240721-3tg4fstckl 3

21/07/2024, 23:42

240721-3qfq8a1bjd 3

Sharing

Copy URL

Twitter E-mail

General

Target

samki.exe
Size

9.0MB
MD5

afef091f9fe18c7af5d3d4c31945c4e4
SHA1

20176b8e74aef4d09f9e113db7663d344637e6c3
SHA256

9ffbef3df627a5de16c39f9c214659517a65d4d16e2fd402885fede9ea2ceca8
SHA512

7a1eae15720f1b4cc5698b3c7f9be276a02c11496a4d3837d4ec0835bc6ae1fd8e0f59ecfa6f4d4fedf44d18b7290d845d36007792a9097cc081970affdb44d7
SSDEEP

49152:UEv+yoBLpYI3OO359LL+/+i9OwwBpzy+O/OEG+wLE61gcgoq9Bl9LL+/+i9OwwBM:FvNUYIePQ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
samki.exe

Files

samki.exe
.exe windows:6 windows x64 arch:x64

1db040f89266d1766549aac125bf7e85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

cositas.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

advapi32

GetTokenInformation
OpenProcessToken

kernel32

InitializeSListHead
SetUnhandledExceptionFilter
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
CreateProcessA
CloseHandle
GetComputerNameExW
GetStdHandle
GetFileInformationByHandleEx
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
GetComputerNameW
GetSystemInfo
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
Sleep
GetModuleHandleA
GetProcAddress
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcessId
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
CreateFileW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
GetModuleHandleW
FormatMessageW
ExitProcess
IsProcessorFeaturePresent
MultiByteToWideChar
WriteConsoleW
CreateThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetSystemTimeAsFileTime
GetCurrentThreadId

user32

MessageBoxA

ntdll

RtlNtStatusToDosError
NtCancelIoFileEx
NtWriteFile
NtDeviceIoControlFile

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memset
memmove
memcpy
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
terminate
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_configure_narrow_argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

1db040f89266d1766549aac125bf7e85

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

user32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 866KB - Virtual size: 866KB

.rdata Size: 8.0MB - Virtual size: 8.0MB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 64KB - Virtual size: 63KB

.rsrc Size: 1024B - Virtual size: 644B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 866KB - Virtual size: 866KB

.rdata
Size: 8.0MB - Virtual size: 8.0MB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 64KB - Virtual size: 63KB

.rsrc
Size: 1024B - Virtual size: 644B

.reloc
Size: 9KB - Virtual size: 8KB