change[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

change.exe
Size

452KB
MD5

c999e74d1aff663e848c9173e25d5477
SHA1

c7299d11a25426f9d6e2b83418d13fa6be7039ee
SHA256

03bce3f4d8df136ec6ff31bed48609b5ca3ab376bf00e05cac49554088c7596e
SHA512

8b0d4f9982522ad724afd7e564796ce8b62eedec063cea12cda09fa9083e1c35c60cccde26bf88b1c6cf611d69b83991959b0d32759b95b6457547fb366d75f3
SSDEEP

6144:hrltRqw34+KZOsrixjpY2v3IQ0xK/uWnVKZW0Kndu4iomCOX7Pkjt5I7wz:ntYwXK3ixjKI3II/FVKBuFmX7PyrI7C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
change.exe

Files

change.exe
.exe windows:6 windows x64 arch:x64

4030eb8f1b0440165164823abc6ca3c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoCreateGuid
CLSIDFromProgID
CoUninitialize

comctl32

InitCommonControlsEx

crypt32

CertCloseStore
CertFindExtension
CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenStore
PFXImportCertStore
CertFindCertificateInStore

wininet

HttpSendRequestExA
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
InternetSetStatusCallback
InternetSetOptionA
InternetWriteFile
InternetReadFileExA
InternetSetCookieA
InternetReadFile
InternetFindNextFileW
InternetGetLastResponseInfoA
FtpFindFirstFileW
FtpGetFileW
FtpPutFileW
FtpDeleteFileW
FtpRenameFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
InternetOpenA
FtpSetCurrentDirectoryW
FtpGetCurrentDirectoryW
FtpCommandW
InternetCrackUrlW
HttpEndRequestA
HttpAddRequestHeadersA
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetConnectA

ws2_32

gethostname
WSAStartup
WSACleanup
getnameinfo
inet_addr
__WSAFDIsSet
inet_ntop
inet_pton
WSAAddressToStringA
WSAGetLastError
WSASetLastError
socket
shutdown
send
select
recv
ntohs
listen
inet_ntoa
htons
htonl
getsockopt
ioctlsocket
connect
gethostbyname
accept
bind
setsockopt
closesocket

secur32

AcquireCredentialsHandleA
DecryptMessage
FreeCredentialsHandle
EncryptMessage
FreeContextBuffer
InitializeSecurityContextA
AcceptSecurityContext
DeleteSecurityContext
QueryContextAttributesA

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetAdaptersAddresses

urlmon

FindMimeFromData

sensapi

IsNetworkAlive

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathIsRelativeW
PathFindFileNameW
PathFindFileNameA
PathIsDirectoryEmptyW

advapi32

LookupPrivilegeValueA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
RegSetKeyValueW
CryptHashData
CryptCreateHash
CryptGenRandom
RegDeleteTreeW
RegGetValueW
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptDestroyHash
CryptAcquireContextA
RegDeleteKeyValueW
CryptReleaseContext
CryptGetHashParam
RegOpenKeyExW

gdi32

GetDeviceCaps
AddFontResourceExW
RemoveFontResourceW
EnumFontFamiliesExW

kernel32

SetLastError
GetCurrentDirectoryW
SetCurrentDirectoryA
TerminateProcess
PeekNamedPipe
CreatePipe
SetHandleInformation
WriteFile
ReadConsoleW
FileTimeToSystemTime
MoveFileW
CopyFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
CreateFileW
GetTimeFormatW
GetDateFormatW
LoadResource
GetLocalTime
CompareFileTime
lstrcmpiW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
GetConsoleWindow
SetCurrentConsoleFontEx
GetCurrentConsoleFontEx
SetConsoleTitleW
GetConsoleTitleW
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
ReadConsoleInputW
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
AllocConsole
MulDiv
LockResource
InitializeSListHead
AddDllDirectory
WideCharToMultiByte
VirtualProtect
ReadFile
CreateFileA
SetStdHandle
GetStdHandle
SetConsoleOutputCP
MultiByteToWideChar
CreateJobObjectA
LocalFree
GlobalLock
GlobalUnlock
GlobalAlloc
SetDefaultDllDirectories
LoadLibraryW
FindResourceA
DeleteFileA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTickCount
CreateThread
GetExitCodeThread
LocalAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SystemTimeToFileTime
SizeofResource
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetCurrentDirectoryW
CreateDirectoryA
DeleteFileW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
Beep
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetTickCount64
AssignProcessToJobObject
SetInformationJobObject
GetModuleHandleA

user32

ShowScrollBar
GetWindowRect
GetDesktopWindow
GetDC
DeleteMenu
GetSystemMenu
keybd_event
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
ExitWindowsEx
CharLowerBuffW
CharUpperBuffW
ReleaseDC

oleaut32

VariantInit
VarDateFromStr
VariantChangeType
GetActiveObject
SysFreeString
SysAllocString
VariantTimeToSystemTime
VariantClear

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

strchr
__current_exception_context
longjmp
memcpy
memcmp
memset
strrchr
wcsstr
memchr
memmove
wcschr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__intrinsic_setjmp
__current_exception
strstr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
__p___argv
_initialize_narrow_environment
_configure_narrow_argv
abort
_invalid_parameter_noinfo_noreturn
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___argc
_cexit
_exit
_seh_filter_exe
strerror
_set_app_type
_errno
_get_initial_narrow_environment
exit
system
_register_onexit_function
_initterm
_initterm_e

api-ms-win-crt-stdio-l1-1-0

_kbhit
fopen
_get_osfhandle
clearerr
_fseeki64
_ftelli64
_pclose
freopen_s
setvbuf
tmpfile
ungetc
fread
freopen
getc
__stdio_common_vfprintf
__stdio_common_vswprintf
fclose
fflush
ferror
tmpnam
_wfopen
fputc
_set_fmode
__p__commode
_fileno
_wfsopen
feof
_telli64
_chsize_s
__stdio_common_vsprintf_s
fputwc
fgetws
fputws
_setmode
__stdio_common_vsprintf
fseek
__stdio_common_vsscanf
puts
fputs
__acrt_iob_func
fwrite
_popen
fgets

api-ms-win-crt-math-l1-1-0

pow
floor
frexp
ldexp
__setusermatherr
fmod
tanh
tan
sqrt
sinh
sin
acos
asin
atan2
ceil
cos
cosh
exp
log
log10

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale
localeconv

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-string-l1-1-0

isdigit
strncpy
strncmp
iswctype
toupper
strpbrk
strspn
wcsncpy
_wcsdup
tolower
iscntrl
isgraph
ispunct
isspace
strcoll
isalnum
isxdigit
islower
_strdup
isupper
isalpha

api-ms-win-crt-time-l1-1-0

_gmtime64
_difftime64
_wutime64
_localtime64
_mktime64
clock
strftime
_localtime64_s
_time64

api-ms-win-crt-heap-l1-1-0

free
realloc
calloc
_callnewh
malloc
_set_new_mode

api-ms-win-crt-environment-l1-1-0

getenv
_wputenv
_wgetenv

api-ms-win-crt-filesystem-l1-1-0

remove
_wstat64
_waccess
rename

Exports

Exports

File_close
File_open
LoadFont
TBuffer
TCOM
TDatetime
TDirectory
TFile
TPipe
TWidget
TZip
WIDGET_METHODS
WM_LUAMAX
console_finalize
detectBOM
fontsize_fromheight
luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkDirname
luaL_checkFilename
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_embedclose
luaL_embedopen
luaL_error
luaL_execresult
luaL_fileresult
luaL_getlasterror
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_require
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_setrawfuncs
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkcinstance
lua_checkinstance
lua_checkstack
lua_close
lua_closeslot
lua_closethread
lua_compare
lua_concat
lua_copy
lua_createcinstance
lua_createinstance
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getevent
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettask
lua_gettop
lua_getupvalue
lua_iscfunction
lua_iscinstance
lua_isinstance
lua_isinteger
lua_isnumber
lua_isobject
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_objectname
lua_optstring
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushlwstring
lua_pushnewinstance
lua_pushnewinstancebyname
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushtask
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_registerevent
lua_registermodule
lua_registerobject
lua_registerwidget
lua_resetthread
lua_resume
lua_rotate
lua_schedule
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_sleep
lua_status
lua_stringtonumber
lua_super
lua_toBuffer
lua_toboolean
lua_tocfunction
lua_tocinstance
lua_toclose
lua_tointegerx
lua_tolstring
lua_tolwstring
lua_tonumberx
lua_topointer
lua_toself
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_uigetinfo
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_widgetconstructor
lua_widgetdestructor
lua_widgetinitialize
lua_widgetproc
lua_xmove
lua_yieldk
luaopen_base
luaopen_compression
luaopen_console
luaopen_coroutine
luaopen_crypto
luaopen_debug
luaopen_embed
luaopen_io
luaopen_math
luaopen_net
luaopen_os
luaopen_package
luaopen_string
luaopen_sys
luaopen_table
luaopen_utf8
luart_tobuffer
search_task
zip_close
zip_entries_delete
zip_entries_total
zip_entry_close
zip_entry_comp_size
zip_entry_crc32
zip_entry_extract
zip_entry_fread
zip_entry_fwrite
zip_entry_index
zip_entry_isdir
zip_entry_name
zip_entry_open
zip_entry_openbyindex
zip_entry_opencasesensitive
zip_entry_read
zip_entry_size
zip_entry_uncomp_size
zip_entry_write
zip_is64
zip_open

Sections

.text
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4030eb8f1b0440165164823abc6ca3c2

Headers

DLL Characteristics

File Characteristics

Imports

ole32

comctl32

crypt32

wininet

ws2_32

secur32

dnsapi

iphlpapi

urlmon

sensapi

shlwapi

advapi32

gdi32

kernel32

user32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 346KB - Virtual size: 345KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 346KB - Virtual size: 345KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB