gupro[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gupro.exe
Size

2.8MB
MD5

83035d6f6c95bbee91cebfda3ce8e717
SHA1

c276fb8f9c498adcbfcae06e87cf1ec63f9795cc
SHA256

039f49f63a4173ed8451b471eef7fa40a3354fc6353213d59a51936dabfc6760
SHA512

45ed62ce82c24914441b1bd69bff75b5b627895abf3a9bd29edcaca68f3a45ca80e87d78db293d6b681c5e4e40dda2dd5c0ce4234f5b4872a3d7f0b34978dbaf
SSDEEP

49152:I7IU6ivGtlqaVwASOrfmrTEbTRjkek2FjufBaCOh5PaOcegDxpVodPgN2gh4E+gx:/+Y39mHqWN2K4E+gPdo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gupro.exe

Files

gupro.exe
.exe windows:6 windows x64 arch:x64

658d69ab223769b3543c79d6327a53f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
CreateProcessA
FreeLibrary
FindNextFileW
FindClose
SetFileAttributesA
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentVariableW
GetFileType
GetModuleHandleExW
DeleteFiber
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
LoadLibraryW
FindFirstFileW
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FormatMessageA
GetFileSizeEx
CreateFileA
Sleep
MultiByteToWideChar
WaitForSingleObject
TerminateProcess
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
SetLastError
GetConsoleScreenBufferInfo
DeleteCriticalSection
CloseHandle
GetLastError
GetTempPathA
GetModuleHandleA
InitializeCriticalSectionEx
GetCurrentProcessId
GetProcAddress
LoadLibraryA
InitializeCriticalSectionAndSpinCount

user32

MessageBoxA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

CryptDecrypt
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW

shell32

ShellExecuteA

msvcp140

??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??Bid@locale@std@@QEAA_KXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ws2_32

getsockname
ntohl
gethostname
sendto
recvfrom
select
__WSAFDIsSet
htonl
WSAIoctl
htons
socket
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
WSAStartup
freeaddrinfo
getaddrinfo
WSAGetLastError
getpeername
WSACleanup
ntohs
ioctlsocket
getsockopt
recv

vcruntime140

strchr
memcmp
memchr
__C_specific_handler
__CxxFrameHandler3
__std_exception_destroy
wcsstr
__std_exception_copy
__std_terminate
strrchr
memcpy
memset
_CxxThrowException
strstr
memmove

api-ms-win-crt-stdio-l1-1-0

_close
_write
_read
__p__commode
_set_fmode
__stdio_common_vswprintf
fputc
fflush
feof
ferror
fgets
_fileno
fseek
ftell
_setmode
fclose
fwrite
__stdio_common_vsprintf
fopen_s
__stdio_common_vsscanf
_wfopen
fputs
__stdio_common_vfprintf
__acrt_iob_func
fopen
_lseeki64
fread
_open

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
realloc
calloc
_callnewh
malloc

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
rename
_stat64i32
remove
_stat64
_fstat64

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort

api-ms-win-crt-string-l1-1-0

tolower
strcspn
strpbrk
strncmp
strspn
isspace
isupper
_stricmp
_strdup
strcmp
strncpy
_strnicmp

api-ms-win-crt-runtime-l1-1-0

signal
_errno
exit
strerror
terminate
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
strerror_s
raise
_seh_filter_exe
_set_app_type
system
_get_initial_narrow_environment
_initterm
_beginthreadex
_getpid
_initterm_e
_configure_narrow_argv
__sys_nerr
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

strtol
atoi
strtoul
strtoll

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

getenv

crypt32

CertEnumCertificatesInStore
CertGetCertificateChain
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptStringToBinaryA
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateChain

normaliz

IdnToAscii

wldap32

ord143
ord46
ord211
ord60
ord45
ord50
ord35
ord22
ord26
ord27
ord217
ord79
ord32
ord30
ord200
ord41
ord301
ord33

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 529KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

658d69ab223769b3543c79d6327a53f3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

ntdll

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

crypt32

normaliz

wldap32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 573KB - Virtual size: 572KB

.data Size: 529KB - Virtual size: 543KB

.pdata Size: 62KB - Virtual size: 62KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 573KB - Virtual size: 572KB

.data
Size: 529KB - Virtual size: 543KB

.pdata
Size: 62KB - Virtual size: 62KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 20KB - Virtual size: 20KB