d[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d.exe
Size 118KB
Sample241113-113bvstmdl
SHA256 6da40ec778630c976ecfef91c63c53f8d822bc5d839466abddb939c06215dbce
MD5 8edc33b7fd7b43798393eb779cf397d0
SHA1 8dde7421215ff41863220c6d2a307e2b1d712859
SHA512 558d459a3acbc0966b64990639e89ecd7e4523a61330cccf4f2f291fc3e1854aa7839b7c7b1164b84ba1b8b3a4be053250d390f09982fd14439ba968db42defb
SSDEEP 1536:xB/ulGsSQDbE8icqZxx2ZEBPX4dSFHBWAxEjc+0ZcN:xB/umH8RI2mBPX4sEAmjc+3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d.exe

File Explorer

d.exe

.exe 118KB

d.exe

IMPHASH 7b7b366c6d4bea4a46a8f75a9d65c2aa
SHA256 6da40ec778630c976ecfef91c63c53f8d822bc5d839466abddb939c06215dbce
MD5 8edc33b7fd7b43798393eb779cf397d0
SHA1 8dde7421215ff41863220c6d2a307e2b1d712859
SHA512 558d459a3acbc0966b64990639e89ecd7e4523a61330cccf4f2f291fc3e1854aa7839b7c7b1164b84ba1b8b3a4be053250d390f09982fd14439ba968db42defb
SSDEEP 1536:xB/ulGsSQDbE8icqZxx2ZEBPX4dSFHBWAxEjc+0ZcN:xB/umH8RI2mBPX4sEAmjc+3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

memset memcpy malloc free strncpy strncmp _strnicmp strlen strcmp memmove strcpy strcat sprintf

kernel32

GetModuleHandleA HeapCreate RemoveDirectoryA GetShortPathNameA HeapDestroy ExitProcess GetTempFileNameA FindResourceA LoadResource SizeofResource HeapFree HeapAlloc LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId InitializeCriticalSection GetCommandLineA GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA GetCurrentProcess DuplicateHandle CloseHandle CreatePipe GetStdHandle CreateProcessA WaitForSingleObject EnterCriticalSection LeaveCriticalSection GetExitCodeProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetVersionExA HeapReAlloc SetLastError GetCurrentDirectoryA SetCurrentDirectoryA DeleteFileA GetTempPathA CreateDirectoryA WriteFile CreateFileA SetFilePointer ReadFile

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA

user32

MessageBoxA SendMessageA GetWindowThreadProcessId IsWindowVisible IsWindowEnabled GetForegroundWindow EnableWindow EnumWindows DestroyWindow GetSysColor GetSysColorBrush CreateWindowExA GetWindowLongPtrA PostMessageA CallWindowProcA SetWindowLongPtrA SetFocus GetWindowTextLengthA GetWindowTextA RedrawWindow RemovePropA DefWindowProcA SetPropA GetPropA GetParent GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRect GetSystemMetrics GetActiveWindow GetWindowRect ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA SetCursorPos LoadImageA SetCursor MapWindowPoints MoveWindow SystemParametersInfoA GetKeyState SetCapture GetCursorPos ReleaseCapture EnumChildWindows GetClientRect FillRect DefFrameProcA GetFocus IsChild GetClassNameA

gdi32

GetStockObject SetTextColor SetBkColor CreateSolidBrush DeleteObject

comctl32

InitCommonControls InitCommonControlsEx