down[.]exe | Triage™

resource
down.exe

down.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 e84f3f36aa22f8b7f7399ce57c68014ea23140e88755516db02b5e056d18dad6
MD5 13476835b5465cf91e4dd7e60e110e56
SHA1 38af4e6440237a3f0f7eb8378a9f82ea473fc9a4
SHA512 90635bef1cfd86608c757270f45658b9aacf582afa249a58b046f533c00925851dc9e6cbd04cf54b7ae55965cc25dd94eac90a7b78b7a4a6da32ad5bbc74f74b
SSDEEP 24576:CMF7WKYDIOMJRvFadXXUfTwrlWB4Zsasxb3+PcRmJDh/:evDIOMJG9kil7bsxZIJDh/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HimselfLocally/Course

SHA256 71ac8f4534eb924876822260553e2c5fdfee7fc9a50790ffd3842339d8a33e35
MD5 6da24f141475e1c94d0baa534671730e
SHA1 699de571854c9eab964ddde0c12f07818259017e
SHA512 49cd5899f209632ac7ef1fd89b5190afa7cccbd78bf87036de2fa8c384d33e9296e9a66476c14c18f9a4ed4cf14cbba8942ddc5c4af90396a494c581195df95f
SSDEEP 192:yHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlE:yHAHhww+/2nlP3r1WAE
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Deck

SHA256 75f00c8c8a5841c48d383384ed01d0d9fea056fc8bb6b7e275e3a29edf37fa7b
MD5 5bdef9e70fa8aac0118e96d47f1e1dbc
SHA1 0989482c6280bf460219d35a1824d760cd9ed3e0
SHA512 83c8fb674878a41fb47ceaa999672910e02e1be6c1c0cdfbd89cb0252a7758b3f7c9620d85e749b57ff7589b5d4d5a8fb4a7f9830add8d4406f65aa4ea0cbd17
SSDEEP 1536:m7fbiJJHwRyoQxEEEHt1yDrScGPz9oXbaIfzwTmmlnieHdKXhVLhQoKqsKlL5JU:m7fS5NSDeuzEhammljKXh1hQoPl1JU
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Devil

SHA256 d97e4faaa2b3f23b147a2a626634794e9e853a3e661472502d6d786edb1c6c7a
MD5 97d7d087cf461ff97c4a4438102c1016
SHA1 8b06c86ad5643e7f2a7300a0823711e9ba436963
SHA512 16c2ae7de0fbba2b2b6f0e5073d4bccd998cc972052f85fbfa70f448aa43634d51b50bffcfdd155bfad0111035067385414b7f94722eb3ae0c5939f934e864f0
SSDEEP 768:HMi5D4zCGuEI4R9/rz1ViWKnw4B8lsMZwLELR:HVqOGuEdRdrz1ViWkwnlst2
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Hb

SHA256 3c4f40140a71ecfde55326f84ca878e5c1a101d457107da13017f5670c6a5bb4
MD5 ef5519b0e3d69ac10317974081e12222
SHA1 49ed090bb19c951090b1633e2fd843c949951f07
SHA512 0cb1cde599e6a93fe2ff68309086fd82c5ccd6cac966504ade451026a8da2f0442ee80fd873fbffdaecf18d8ab729317bdc017dd3744fbd744fa5b892b70951c
SSDEEP 1536:n6+soL5ZD2wbfiKZ3vDx8K8X8MfnaqwZqnakDVGP:ndtDt+cfDx8K8b/RAqnakm
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Herself

SHA256 f9d2fe0dff05d8485cc1104e64940673055bd2ee3ff90297dad183fb6356eae3
MD5 352d59010c3a1ad07c6cc631429c3898
SHA1 d84012a103d428bda710012a40b5acd5aa2e8f05
SHA512 cfa507f35ab27e942e756c1d60599926706730bf207b5ebeb46702e52ce67428f16a22c4e7565d66992b69b26f76f651dda2bf17b6ef36592aff57e0587e343d
SSDEEP 12288:JV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:zxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Killing

SHA256 f63d2eb292cab30f8e1ab7d9e2ed7b3b19b2be588da4fed455265ea9a6264a11
MD5 a3dbd9ae326c770abcc54b0fdd7a22eb
SHA1 97d0e17dc71226a7816e1cbb3e070fa8a4872ff6
SHA512 5adda01b4500af1f5c09f0a78db320cf7611e6b595d2d9ebc907b5f70dcd4277d11d0056e4ac66fc72f3347088f14650635ba6a7ab8c8438772a52e3966fca71
SSDEEP 384:g8TL/Ygzgt+BhpjMZ+Th/ISJwf36l73gKidtvElpQRX:lk+BhpjMZM/IQuO3VidtvEzk
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/London

SHA256 af8444e8ee47f86fb80bcca4b65c0e2db813240a6479a44ed7c0d4ad310d43e2
MD5 463606075e8bc9b04f96c6f893469f91
SHA1 4fe270343a5a65b1357a0ff96f1d474cfd97bbea
SHA512 0a440cc3052460b32ff289a897eb641568811572376d466cbdba786c02c585e25c2699aef7860ffcb460933f62d120255bbdfe6926135a5c5fe56b3a910e550d
SSDEEP 1536:0PfJg+cBXg/tHU4pmgOUlRixa03o64nBREl6oW+9zY1NkR+T:kfz4XgNU4p6CixajSR/B4+Ro
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Pichunter

SHA256 02f813b83cd0126e876f387ac82b51289a9888e7b142fe41a543aaf57e91d225
MD5 9b7919ea2318bec3ef9666c982b77119
SHA1 55e2940fc3dc8f377b16ee06c58ee066e7e766f0
SHA512 e5619ba41d1380d853fcb519dd7acaea1d9946a5f336241a0f396c75c20499a8da72487b6fb0713edf923ba79580425211d0f00e1ff650486d43f16c2e18c2af
SSDEEP 1536:vRyZnjSkaJqCzPrxTZRLRHtvFz352GMg5Y+CnZNXlMX1ZUhrDVKSYpfHMi+ASNPo:vEeGCzzxTZRLXvFDDMg5YbBGFZUFDEfr
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Rapid

SHA256 3739a2c7bf513612f2d616bb10b0221512fa4cce0222441d7ba96ffdfb553387
MD5 78a2388d3143b203f0d68eda1962fd9c
SHA1 743bc34a72ed75189c491f5c14dcfe3ce3f4f434
SHA512 e9dc06b5bdef912d33b129fad85561083ee8e56052929e5fe4dde9ed02d65fa6d2c3218ff045abbe7770a662959af00dff6a56b84f684cc0f00451b77e764255
SSDEEP 1536:DxgPJZhK6L8YpfBRPnrzIhSh7khcQTqD22qjDoQT0FuTngZ7rpG:ybQCRDs0AheqjUQIKn+G
MD5 SHA1 SHA512 SSDEEP

HimselfLocally/Royal

SHA256 207eb1026caac4ee644f3b7e1be0d455ac93298b07e329371e1bbd81cc6dc50e
MD5 f81ed71b4707976f2074491adb2e4f3c
SHA1 3bc06f946916884ddc04bf534deb823ac94e34e8
SHA512 28eb57f3a5bbb52a865744c999a11345360a2332d1e5a52b70db58b410944f387c4ba3d5a0bcded792909848d7693f898cb66900d0e94c74994bf1a1d71648e2
SSDEEP 1536:aWLCNmECA0irmrbv+YsieH8wmpOVKX9EIN6ro3d:ROHd+6Z8hp9Vt3d
MD5 SHA1 SHA512 SSDEEP

WelfareGerald/Charter

SHA256 4781b721205bcc4a912534f0f006acc8f49f220909b45c82e5d70ca718e80b84
MD5 ec287f03de31d75d7b65333ad856d57d
SHA1 65b43b521b8afba6d9d3c325f71ef104ba1212f8
SHA512 7e560fd33df0f4d8a1c9f954447dd29a8311a9dad6ef3ca3984c102b9a01952028ba146729e080f0de8bf3287f05d510af684000d3f6bfdfe921ee9b6b2629d0
SSDEEP 1536:lQ296HDQqGSDKEr5Ysl+m6YbwebFnDE6xrnuXUusGn7XmYaCr4zWPXb54:lsrjDK0ysl+4bJb9DEenAUGXs9WPl4
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

down.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

HimselfLocally/Course

HimselfLocally/Deck

HimselfLocally/Devil

HimselfLocally/Hb

HimselfLocally/Herself

HimselfLocally/Killing

HimselfLocally/London

HimselfLocally/Pichunter

HimselfLocally/Rapid

HimselfLocally/Royal

WelfareGerald/Charter