Swift[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Swift.exe
Size

12.7MB
MD5

8bae1c0cb183723f20a52f7e08e1be67
SHA1

fe6f34bb3ee45bbd5870de8ffc44b3e8a71f7caa
SHA256

2f3031d29e955a260e25f1ba8537570ea8dd4e26ff6bdcb1799b461a40c00310
SHA512

53c621a0aef858a89d0b2f935968393fb04b95177305e002fdbe9bd7545961d832827a5c3fb24bb777fbc4876cda9c2595ce27ed2af33378072a37bb256e8217
SSDEEP

196608:XuKfq2e6DQCekczMb5b/aUMOcvictDZi:Xle6smczMNzaUxmictNi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Swift.exe

Files

Swift.exe
.exe windows:6 windows x64 arch:x64

70a8bc8aa956d69427765807f7cfd3f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Swift.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

NtCreateFile
RtlCaptureContext
NtQuerySystemInformation
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryInformationProcess
NtCancelIoFileEx
NtReadFile
RtlGetVersion
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
RtlPcToFileHeader
RtlUnwindEx

user32

IsWindow
GetSystemMetrics
GetWindowTextLengthW
SetWindowTextW
EnumChildWindows
CreateWindowExW
RegisterWindowMessageA
RegisterTouchWindow
RegisterClassExW
RegisterRawInputDevices
SendInput
MsgWaitForMultipleObjectsEx
SetWindowLongPtrW
SetCapture
ShowWindow
GetSystemMenu
EnableMenuItem
SendMessageW
GetWindowRect
SetWindowLongW
GetForegroundWindow
SetCursorPos
GetClipCursor
ClipCursor
ShowCursor
GetMenu
SetWindowDisplayAffinity
GetWindowLongPtrW
SetForegroundWindow
CreateIcon
InvalidateRgn
TrackPopupMenu
GetRawInputData
CheckMenuItem
GetDC
DispatchMessageA
GetMessageA
GetKeyboardLayout
AdjustWindowRectEx
SetWindowPos
GetWindowTextW
IsWindowVisible
CreateAcceleratorTableW
DestroyIcon
PostQuitMessage
AppendMenuW
DestroyAcceleratorTable
GetClientRect
ClientToScreen
CreatePopupMenu
CreateMenu
SetMenuItemInfoW
DestroyWindow
ReleaseCapture
GetCursorPos
RegisterClassW
IsIconic
GetActiveWindow
SetMenu
VkKeyScanW
GetAsyncKeyState
GetKeyboardState
ToUnicodeEx
GetKeyState
MapVirtualKeyExW
RedrawWindow
PostMessageW
MonitorFromPoint
EnumDisplayMonitors
SystemParametersInfoA
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW
IsProcessDPIAware
SetCursor
LoadCursorW
GetWindowPlacement
SetWindowPlacement
PeekMessageW
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
PostThreadMessageW
TranslateMessage
TranslateAcceleratorW
DispatchMessageW
GetAncestor
GetMessageW
MapVirtualKeyW

kernel32

CreateMutexA
GetProcessHeap
GetExitCodeProcess
K32GetPerformanceInfo
GlobalMemoryStatusEx
HeapFree
FreeLibrary
WaitForSingleObjectEx
GetProcAddress
OpenProcess
WaitForSingleObject
GetTempPathW
GetFullPathNameW
CreateThread
WideCharToMultiByte
WriteConsoleW
LocalFree
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
RemoveDirectoryW
MoveFileExW
GetLastError
DeleteFileW
FindFirstFileW
FormatMessageW
GetSystemTimes
MultiByteToWideChar
GetProcessTimes
CreateDirectoryW
GetFileInformationByHandleEx
FindClose
FindNextFileW
ReleaseMutex
HeapReAlloc
VirtualQueryEx
GetSystemTimePreciseAsFileTime
CreateFileW
GetCurrentProcessId
GetSystemInfo
CloseHandle
GetCurrentThreadId
GetModuleHandleW
GetProcessIoCounters
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RaiseException
QueryPerformanceFrequency
TerminateProcess
SleepEx
WriteFileEx
GetStdHandle
GetModuleHandleA
GetNativeSystemInfo
lstrlenW
GetUserDefaultLocaleName
EncodePointer
SetFileInformationByHandle
LoadLibraryA
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
QueryPerformanceCounter
SetWaitableTimer
CreateWaitableTimerExW
SwitchToThread
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
GetConsoleMode
GetFileInformationByHandle
Sleep
SetFileCompletionNotificationModes
TlsFree
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetHandleInformation
DuplicateHandle
GetCurrentProcess
GetEnvironmentVariableW
DeleteCriticalSection
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
HeapAlloc
ReleaseSRWLockExclusive
ReadProcessMemory
OutputDebugStringW
OutputDebugStringA
GetModuleFileNameW
GetFileAttributesW

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
CoTaskMemAlloc
CoCreateInstance
RegisterDragDrop
CoInitializeEx
CoUninitialize
RevokeDragDrop

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect

shell32

SHAppBarMessage
SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteW
SHCreateItemFromParsingName
DragQueryFileW
Shell_NotifyIconGetRect
DragFinish
Shell_NotifyIconW

pdh

PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCloseQuery
PdhCollectQueryData
PdhAddEnglishCounterW
PdhRemoveCounter

powrprof

CallNtPowerInformation

secur32

FreeCredentialsHandle
DecryptMessage
AcquireCredentialsHandleA
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
DeleteSecurityContext
InitializeSecurityContextW
ApplyControlToken
AcceptSecurityContext

advapi32

GetTokenInformation
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
SystemFunction036
OpenProcessToken
CopySid
IsValidSid
GetLengthSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

psapi

GetModuleFileNameExW

oleaut32

SysStringLen
SysFreeString
SetErrorInfo
GetErrorInfo

ws2_32

freeaddrinfo
getaddrinfo
closesocket
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
WSASend
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername

crypt32

CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertCloseStore
CertDuplicateStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertDuplicateCertificateChain

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc
pow
round
__setusermatherr
floor

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_set_new_mode
calloc
malloc

api-ms-win-crt-string-l1-1-0

strcpy_s
wcslen
_wcsicmp
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
_crt_atexit
_configure_narrow_argv
_set_app_type
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
_initialize_narrow_environment
abort
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
__p___argv
__p___argc
_initterm_e
_exit
exit
_cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70a8bc8aa956d69427765807f7cfd3f1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

user32

kernel32

gdi32

dwmapi

ole32

comctl32

shell32

pdh

powrprof

secur32

advapi32

psapi

oleaut32

ws2_32

crypt32

uxtheme

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 6.7MB - Virtual size: 6.7MB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 296KB - Virtual size: 295KB

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 49KB - Virtual size: 48KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 6.7MB - Virtual size: 6.7MB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 296KB - Virtual size: 295KB

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 49KB - Virtual size: 48KB