skaza[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

skaza.exe
Size

395KB
MD5

e795c913d280fcc381dc91a8bf6aed7f
SHA1

37b28ff46611bf46728598c407018191aa521704
SHA256

d8824ce26da0301fa43fcc8e74f60a863bbc1b48bdd9c4535b3f9cd82fdfb548
SHA512

3e3690444a95d91457ecbac56549f89d1ac275ea0af1aace2098c13dd8dfe1649dcf4c3953228ee148d9440da6e7c22d7c87b6725989a3e4faf0ebb01f84f1a6
SSDEEP

12288:uCFUGe9aJ4TTSLFLA7mzBBlzFfmZQ8tICLXQJ:uCFUGQU4TTSLdA7mzB7Ff8Q8CiXQJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
skaza.exe

Files

skaza.exe
.exe windows:6 windows x64 arch:x64

9aff53e2c48c496484f1e8334a90e01a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoCreateGuid
CLSIDFromProgID
CoUninitialize

comctl32

InitCommonControlsEx

crypt32

CertCloseStore
CertFindExtension
CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenStore
PFXImportCertStore
CertFindCertificateInStore

wininet

HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetStatusCallback
InternetSetOptionA
InternetWriteFile
InternetReadFileExA
InternetSetCookieA
InternetReadFile
InternetFindNextFileW
InternetGetLastResponseInfoA
FtpFindFirstFileW
FtpGetFileW
FtpPutFileW
FtpDeleteFileW
FtpRenameFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpSetCurrentDirectoryW
FtpGetCurrentDirectoryW
FtpCommandW
InternetCrackUrlW
InternetCloseHandle
InternetConnectA
HttpQueryInfoA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA

ws2_32

htonl
htons
inet_ntoa
listen
connect
closesocket
ntohs
recv
select
send
setsockopt
shutdown
getsockopt
WSASetLastError
WSAGetLastError
WSAAddressToStringA
inet_pton
inet_ntop
__WSAFDIsSet
inet_addr
gethostbyname
gethostname
WSAStartup
WSACleanup
getnameinfo
socket
bind
accept
ioctlsocket

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
AcceptSecurityContext
DeleteSecurityContext
QueryContextAttributesA
FreeContextBuffer
EncryptMessage
DecryptMessage
FreeCredentialsHandle

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetAdaptersAddresses

urlmon

FindMimeFromData

sensapi

IsNetworkAlive

shlwapi

PathFindFileNameW
PathIsRelativeW
PathFindExtensionW
PathRemoveFileSpecW
PathIsDirectoryEmptyW
PathFindFileNameA

advapi32

LookupPrivilegeValueA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
RegSetKeyValueW
CryptHashData
CryptCreateHash
CryptGenRandom
RegDeleteTreeW
RegGetValueW
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptDestroyHash
CryptAcquireContextA
RegDeleteKeyValueW
CryptReleaseContext
CryptGetHashParam
RegOpenKeyExW

gdi32

GetDeviceCaps
AddFontResourceExW
RemoveFontResourceW
EnumFontFamiliesExW

kernel32

SetCurrentDirectoryA
TerminateProcess
PeekNamedPipe
CreatePipe
SetHandleInformation
WriteFile
ReadConsoleW
FileTimeToSystemTime
MoveFileW
CopyFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
CreateFileW
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
GetLocalTime
lstrcmpiW
WideCharToMultiByte
FindNextFileW
GetCurrentDirectoryW
FindClose
CreateDirectoryW
GetConsoleWindow
SetCurrentConsoleFontEx
GetCurrentConsoleFontEx
SetConsoleTitleW
GetConsoleTitleW
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
ReadConsoleInputW
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
AllocConsole
MulDiv
Sleep
ReadFile
VirtualProtect
LoadResource
InitializeSListHead
FindFirstFileW
SetLastError
CreateFileA
SetStdHandle
GetStdHandle
SetConsoleOutputCP
MultiByteToWideChar
CreateJobObjectA
LocalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetModuleHandleA
SizeofResource
LoadLibraryW
FindResourceA
DeleteFileA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTickCount
CreateThread
GetExitCodeThread
LocalAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
CompareFileTime
LockResource
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetCurrentDirectoryW
CreateDirectoryA
DeleteFileW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
Beep
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetTickCount64
AssignProcessToJobObject
SetInformationJobObject

user32

SetClipboardData
GetClipboardData
OpenClipboard
keybd_event
GetSystemMenu
DeleteMenu
CharLowerBuffW
CloseClipboard
ExitWindowsEx
EmptyClipboard
GetDC
ReleaseDC
ShowScrollBar
GetWindowRect
GetDesktopWindow
CharUpperBuffW

oleaut32

VarDateFromStr
VariantChangeType
SysFreeString
VariantTimeToSystemTime
VariantClear
SysAllocString
VariantInit
GetActiveObject

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception
__intrinsic_setjmp
__C_specific_handler
_CxxThrowException
__std_exception_destroy
strstr
strchr
longjmp
memcpy
memcmp
memset
strrchr
memchr
memmove
wcschr
__current_exception_context
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
strerror
_exit
_c_exit
_invalid_parameter_noinfo_noreturn
_crt_atexit
abort
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
terminate
system
_errno
_initterm
__p___argv
__p___argc
exit
_initterm_e
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_fileno
__acrt_iob_func
_kbhit
freopen_s
_get_osfhandle
clearerr
_fseeki64
_ftelli64
_pclose
_popen
setvbuf
tmpfile
ungetc
__stdio_common_vswprintf
__p__commode
fputs
puts
__stdio_common_vsprintf
_set_fmode
fclose
feof
tmpnam
_wfopen
fputc
ferror
fflush
fopen
_wfsopen
fread
_telli64
_chsize_s
__stdio_common_vsprintf_s
fputwc
fgetws
fputws
_setmode
fgets
fseek
__stdio_common_vsscanf
fwrite
freopen
getc
__stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

ldexp
fmod
__setusermatherr
frexp
pow
floor
tanh
tan
sqrt
sinh
sin
log10
log
acos
asin
atan2
ceil
cos
cosh
exp

api-ms-win-crt-string-l1-1-0

isdigit
isalnum
toupper
iswctype
isalpha
isupper
strncpy
islower
isxdigit
strcoll
strspn
strpbrk
isspace
ispunct
strcmp
isgraph
iscntrl
tolower
wcsncpy
_strdup
_wcsdup
strncmp

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale
localeconv

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-time-l1-1-0

_wutime64
_localtime64_s
strftime
_time64
_mktime64
_localtime64
_gmtime64
_difftime64
clock

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
malloc
free
_set_new_mode
calloc

api-ms-win-crt-environment-l1-1-0

getenv
_wputenv
_wgetenv

api-ms-win-crt-filesystem-l1-1-0

remove
_waccess
rename
_wstat64

Exports

Exports

File_close
File_open
LoadFont
TBuffer
TCOM
TDatetime
TDirectory
TFile
TPipe
TWidget
TZip
WIDGET_METHODS
WM_LUAMAX
console_finalize
detectBOM
fontsize_fromheight
luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkFilename
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_embedclose
luaL_embedopen
luaL_error
luaL_execresult
luaL_fileresult
luaL_getlasterror
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_require
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_setrawfuncs
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkcinstance
lua_checkinstance
lua_checkstack
lua_close
lua_closeslot
lua_closethread
lua_compare
lua_concat
lua_copy
lua_createcinstance
lua_createinstance
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getevent
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettask
lua_gettop
lua_getupvalue
lua_iscfunction
lua_iscinstance
lua_isinstance
lua_isinteger
lua_isnumber
lua_isobject
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_objectname
lua_optstring
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushlwstring
lua_pushnewinstance
lua_pushnewinstancebyname
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushtask
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_registerevent
lua_registermodule
lua_registerobject
lua_registerwidget
lua_resetthread
lua_resume
lua_rotate
lua_schedule
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_sleep
lua_status
lua_stringtonumber
lua_super
lua_toBuffer
lua_toboolean
lua_tocfunction
lua_tocinstance
lua_toclose
lua_tointegerx
lua_tolstring
lua_tolwstring
lua_tonumberx
lua_topointer
lua_toself
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_widgetconstructor
lua_widgetdestructor
lua_widgetinitialize
lua_widgetproc
lua_xmove
lua_yieldk
luaopen_base
luaopen_compression
luaopen_console
luaopen_coroutine
luaopen_crypto
luaopen_debug
luaopen_embed
luaopen_io
luaopen_math
luaopen_net
luaopen_os
luaopen_package
luaopen_string
luaopen_sys
luaopen_table
luaopen_utf8
luart_tobuffer
search_task

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9aff53e2c48c496484f1e8334a90e01a

Headers

DLL Characteristics

File Characteristics

Imports

ole32

comctl32

crypt32

wininet

ws2_32

secur32

dnsapi

iphlpapi

urlmon

sensapi

shlwapi

advapi32

gdi32

kernel32

user32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.rdata Size: 64KB - Virtual size: 64KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 285KB - Virtual size: 285KB

.rdata
Size: 64KB - Virtual size: 64KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 3KB - Virtual size: 2KB