aqsfwoz[.]exe | Triage™

General

Target
aqsfwoz.exe
Size 11.8MB
Sample240903-h5px8a1bmp
SHA256 256663a3854aa83f75a6ead0fdf1668833e9abe83a863f09544b7a7e71764414
MD5 07f1415abcdb3eb7169afb3d85d9dae5
SHA1 b44b0e5a810ce27106fb31a4f955210210c53929
SHA512 6bf34ded56adba5af36256039e69f0157c344b99dbb4689325b6e55c4f1172a70fda4c7adcb2c908e402f91145722207aa01551dde93121289ccb49d2c48f447
SSDEEP 6144:Mw0VDy74AW/47pwSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS:Mw0VD7AW/49
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aqsfwoz.exe

File Explorer

aqsfwoz.exe

.exe 11.8MB

aqsfwoz.exe

IMPHASH 3b8d07093a198841d1924d87c0b0e4ec
SHA256 256663a3854aa83f75a6ead0fdf1668833e9abe83a863f09544b7a7e71764414
MD5 07f1415abcdb3eb7169afb3d85d9dae5
SHA1 b44b0e5a810ce27106fb31a4f955210210c53929
SHA512 6bf34ded56adba5af36256039e69f0157c344b99dbb4689325b6e55c4f1172a70fda4c7adcb2c908e402f91145722207aa01551dde93121289ccb49d2c48f447
SSDEEP 6144:Mw0VDy74AW/47pwSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS:Mw0VD7AW/49
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sowuwutucomu\zositefa.pdb

kernel32

EnumDateFormatsW OpenMutexW GetConsoleAliasExesLengthA CopyFileExA ReadConsoleOutputCharacterW FillConsoleOutputAttribute GetCommConfig QueryDosDeviceA EnumCalendarInfoExA GetProcessPriorityBoost CreateJobSet AddConsoleAliasW CreateFileA SetMailslotInfo GetWindowsDirectoryW GetModuleHandleA GlobalHandle CreateDirectoryExW GetLogicalDriveStringsA ReadConsoleInputW FindNextVolumeMountPointW OpenWaitableTimerW GetVersionExA SearchPathA RequestWakeupLatency CallNamedPipeW GetCurrentDirectoryW GetDriveTypeW CreateMailslotW BuildCommDCBAndTimeoutsA GetProcAddress LoadLibraryA LocalAlloc GetBinaryTypeA GetCPInfoExW WriteConsoleOutputA GetCommandLineW EnumSystemCodePagesW CancelTimerQueueTimer GetHandleInformation FindResourceA GetModuleHandleW CreateJobObjectW FindFirstVolumeA GlobalFlags CreateNamedPipeW LocalUnlock InterlockedIncrement CloseHandle GetTickCount GetShortPathNameA DeviceIoControl GetLogicalDriveStringsW GetConsoleTitleA InterlockedCompareExchange EnumCalendarInfoW InterlockedExchange GetNamedPipeHandleStateW DeactivateActCtx GenerateConsoleCtrlEvent MoveFileW AddAtomA SetThreadPriority FreeEnvironmentStringsW SetConsoleTitleW SetVolumeMountPointW VirtualProtect _hread ClearCommBreak QueryMemoryResourceNotification GlobalFindAtomW GetMailslotInfo HeapWalk SetFilePointer GetVolumeInformationA LoadLibraryW VerifyVersionInfoA GetLastError HeapFree HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode MultiByteToWideChar HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile

gdi32

GetCharABCWidthsA GetCharWidthA

winhttp

WinHttpWriteData

Sharing