runner[.]exe | Triage™

General

Target
runner.exe
Size 790KB
Sample240907-dreg4ssbql
SHA256 428fdf094c58f6dd9eda7f6efafaddcb43b482940bdca405db4b62e3a65c3c95
MD5 afc84a8b4609d2df281fb3490e109bbd
SHA1 60e14e134728ddb00e519ce1097ee3abdee95459
SHA512 11c43645a8f7bd215dd5bcc76286aec7a309d030c83f33ab9903f734535fc376b01f545d05966a7e02c0e9ba4e962c573ad7c2320e03b2aa5adcbacf4136918a
SSDEEP 12288:2pV8ixHDVaVHqfEqpCet/A/k3i5trFvXUbmYTZ5qXxPezdE2vZ5d66gp9/:QmMKHqvt/A/kS/r9XitTZ4XtyZc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
runner.exe

File Explorer

runner.exe

.exe 790KB

runner.exe

IMPHASH e412cb3cd2101fa7976d1b955d53f138
SHA256 428fdf094c58f6dd9eda7f6efafaddcb43b482940bdca405db4b62e3a65c3c95
MD5 afc84a8b4609d2df281fb3490e109bbd
SHA1 60e14e134728ddb00e519ce1097ee3abdee95459
SHA512 11c43645a8f7bd215dd5bcc76286aec7a309d030c83f33ab9903f734535fc376b01f545d05966a7e02c0e9ba4e962c573ad7c2320e03b2aa5adcbacf4136918a
SSDEEP 12288:2pV8ixHDVaVHqfEqpCet/A/k3i5trFvXUbmYTZ5qXxPezdE2vZ5d66gp9/:QmMKHqvt/A/kS/r9XitTZ4XtyZc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

17152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tufida.pdb

kernel32

SetThreadContext SetFilePointer lstrlenA GetConsoleAliasesLengthW GetConsoleAliasExesA MapUserPhysicalPages InterlockedIncrement MoveFileExW OpenJobObjectA WriteConsoleInputA SetComputerNameW AddConsoleAliasW GetModuleHandleW GetGeoInfoW WaitNamedPipeW TlsSetValue GlobalAlloc LoadLibraryW ReadConsoleInputA GetConsoleAliasExesLengthW GetFileAttributesA CreateMutexW ReadFile GetSystemDirectoryA GetVolumePathNameA LCMapStringA GetConsoleAliasesW GetLastError GetProcAddress VirtualAlloc EnumSystemCodePagesW LoadLibraryA UnhandledExceptionFilter LocalAlloc CreateHardLinkW CreateEventW WriteProfileSectionW FindAtomA FindNextFileA GetFileAttributesExW LCMapStringW WriteConsoleW GetSystemDefaultLangID HeapAlloc Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree HeapReAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA RaiseException TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId InterlockedDecrement InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar SetStdHandle GetModuleHandleA HeapSize GetLocaleInfoA WriteConsoleA GetConsoleOutputCP GetStringTypeA GetStringTypeW FlushFileBuffers CreateFileA CloseHandle

gdi32

GetTextExtentExPointW

Sharing