liar[.]exe | Triage™

General

Target
liar.exe
Size 704KB
Sample240907-dzd7basenp
SHA256 65095394b8ee9ff4db8b8b7d88dfb1a3936450010fdd7266e9334e323b6c0da2
MD5 eeca05d25df9dd3ac6649d544af8b130
SHA1 02792783b0dcce6668431e6f00c82f25a9b5317a
SHA512 a7ffe32a4fbb976287d63ca143cd003fd2c5285bcb93f4e8270c16b582dc974e49ae1b33aa6197addfbb3e179b557071f1ef0e44c9cd8eb5fdab53d55ae04143
SSDEEP 12288:NmiX7brhCcIDkqBiBXrY0oZCMVzD/KAKExWfn52rFII74EbFOVwPBOu:wiXlCVDDfZvVHvKjf50IK1Rmw5f
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
liar.exe

File Explorer

liar.exe

.exe 704KB

liar.exe

IMPHASH 4054b693d3c05398378812172a4ea0e8
SHA256 65095394b8ee9ff4db8b8b7d88dfb1a3936450010fdd7266e9334e323b6c0da2
MD5 eeca05d25df9dd3ac6649d544af8b130
SHA1 02792783b0dcce6668431e6f00c82f25a9b5317a
SHA512 a7ffe32a4fbb976287d63ca143cd003fd2c5285bcb93f4e8270c16b582dc974e49ae1b33aa6197addfbb3e179b557071f1ef0e44c9cd8eb5fdab53d55ae04143
SSDEEP 12288:NmiX7brhCcIDkqBiBXrY0oZCMVzD/KAKExWfn52rFII74EbFOVwPBOu:wiXlCVDDfZvVHvKjf50IK1Rmw5f
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

20789

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReleaseMutex ReadConsoleInputW VerifyVersionInfoW GetCPInfoExW CreateEventW SetLocaleInfoA GetProcAddress GlobalAlloc DeleteFileA EnumResourceTypesW GetBinaryTypeA SetLastError LocalFlags WriteProfileStringW GetComputerNameExA GetConsoleAliasA WriteProfileSectionW SetSystemPowerState FindFirstVolumeMountPointW GetModuleHandleW EnumResourceLanguagesA SetDefaultCommConfigW EnumTimeFormatsA GetCurrentActCtx DeleteVolumeMountPointW GetStartupInfoW IsProcessInJob WritePrivateProfileStringA FoldStringA GetShortPathNameA FindNextFileA EnumCalendarInfoW LocalAlloc CreateEventA GetLastError RtlCaptureContext GetStringTypeExA GetWindowsDirectoryA SetVolumeMountPointA LoadLibraryA DecodePointer EncodePointer GetCommandLineW HeapSetInformation IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException HeapFree Sleep RtlUnwind SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW HeapAlloc HeapReAlloc WriteConsoleW HeapSize CloseHandle CreateFileW

gdi32

GetBoundsRect

advapi32

GetKernelObjectSecurity

Sharing