tsu_han[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tsu_han.exe
Size

1.7MB
MD5

85123f9cdf6f11d359cc304fb0fda4de
SHA1

405ca1d3ec4b6b5c34a2fb91722bc32d71aacb7d
SHA256

2bdf5be89f1ce01fbf9b5dc034e3ab4ee9c3960f2f508cc968a1a657c1f304d0
SHA512

5979c829a6f17c85d9da85ddb2bfea35038f4f02cb842f2b331d4a0f8b2f75e2cb6866c5beba88a6ce3decd03fe90dd5f4818903b1f58ad77822b7ce9ad24e79
SSDEEP

12288:EVr49/nhG8rgWnb6JjCwTFHpqMVwOqgNnArphdPLvK+Rl8b6h0Op8yXn+Cju1+TE:A49/h6JZ+OLnArTlp7Xtu1+THWRXN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tsu_han.exe

Files

tsu_han.exe
.exe windows:4 windows x86 arch:x86

3a2aded5131236b77efb28a8adce4f1d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

kernel32

FileTimeToLocalFileTime
GetTickCount
RtlUnwind
RaiseException
ExitProcess
TerminateProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
CreateThread
ExitThread
HeapSize
HeapReAlloc
GetACP
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
FileTimeToSystemTime
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
Sleep
InterlockedExchange
CloseHandle
CreateFileA
ReadFile
GetFileSize
WriteFile
SetThreadPriority
GetLastError
CreateMutexA
LockResource
LoadResource
FindResourceA
WaitForSingleObject
GetVersionExA
GetModuleHandleA
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
WideCharToMultiByte
SizeofResource
InterlockedIncrement
InterlockedDecrement
lstrlenA
SetErrorMode
GetFileTime
GetFileAttributesA
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
MultiByteToWideChar
LocalFree
FormatMessageA
lstrcmpA
GetProfileStringA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetThreadLocale
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
lstrcpyA
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
GlobalUnlock
MulDiv
SetLastError
GlobalFree
CreateEventA
SuspendThread
ResumeThread
SetEvent
GetModuleFileNameA
GlobalLock
GlobalAlloc
GetCurrentThread
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
SetStdHandle

user32

SetRect
GetNextDlgGroupItem
MessageBeep
InflateRect
RegisterClipboardFormatA
CreateDialogIndirectParamA
EndDialog
GetSysColorBrush
LoadCursorA
PtInRect
GetClassNameA
LoadStringA
CharUpperA
DestroyMenu
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
MapDialogRect
SetWindowContextHelpId
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
GetNextDlgTabItem
GetMessageA
GetActiveWindow
ValidateRect
IsWindowEnabled
PostQuitMessage
SendDlgItemMessageA
MapWindowPoints
GetSysColor
GetFocus
SetActiveWindow
IsWindow
SetFocus
CopyAcceleratorTableA
CopyRect
GetTopWindow
IsChild
GetParent
GetCapture
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
DrawFocusRect
DefDlgProcA
IsWindowUnicode
GetMessagePos
GetLastActivePopup
GetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowRect
GetClientRect
GetKeyboardState
TranslateMessage
DispatchMessageA
CharNextA
AdjustWindowRectEx
PeekMessageA
PostThreadMessageA
SetWindowPos
IsWindowVisible
GetWindowPlacement
SetWindowPlacement
GetDesktopWindow
EnumWindows
EnableWindow
ScreenToClient
SendMessageA
ClientToScreen
WINNLSEnableIME
ShowCursor
ReleaseCapture
SetCapture
SetCursor
SetWindowRgn
InvalidateRect
LoadMenuA
CheckMenuItem
EnableMenuItem
GetSubMenu
SetForegroundWindow
GetCursorPos
GetSystemMetrics
MessageBoxA
LoadImageA
LoadIconA
UpdateWindow
PostMessageA
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
WinHelpA

gdi32

GetClipBox
SetTextColor
SetBkColor
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SelectObject
GetStockObject
SelectPalette
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
GetPaletteEntries
DeleteObject
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextColor
GetBkColor
DPtoLP
LPtoDP
GetMapMode
PatBlt
StretchBlt
RealizePalette
CreateCompatibleDC
BitBlt
CreatePalette
CreateHalftonePalette
GetNearestPaletteIndex
CreateDIBSection
GetObjectA
CreateRectRgn
CombineRgn
GetTextExtentPointA
CreateDIBitmap
CreateSolidBrush

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA

shell32

Shell_NotifyIconA

comctl32

ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries
OleUninitialize
OleInitialize
OleFlushClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
CoCreateInstance
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemFree
CoTaskMemAlloc
OleIsCurrentClipboard

olepro32

ord253

oleaut32

SysStringLen
SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString

Sections

.text
Size: 904KB - Virtual size: 901KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 616KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a2aded5131236b77efb28a8adce4f1d

Headers

File Characteristics

Imports

winmm

d3d8

dinput8

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 904KB - Virtual size: 901KB

.rdata Size: 136KB - Virtual size: 133KB

.data Size: 100KB - Virtual size: 167KB

.data1 Size: 4KB - Virtual size: 2KB

.rsrc Size: 616KB - Virtual size: 612KB

.text
Size: 904KB - Virtual size: 901KB

.rdata
Size: 136KB - Virtual size: 133KB

.data
Size: 100KB - Virtual size: 167KB

.data1
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 616KB - Virtual size: 612KB