Holzer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Holzer.exe
Size 135KB
Sample241113-pttklavqcr
SHA256 cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce
MD5 c971c68b4e58ccc82802b21ae8488bc7
SHA1 7305f3a0a0a0d489e0bcf664353289f61556de77
SHA512 ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7
SSDEEP 3072:2EYGNIaWY/0kTKxIJXtJ0YCHiQtSetFITTTTTHvvvvvNKB:HN5TKvr9PuKB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Holzer.exe

File Explorer

Holzer.exe

.exe 135KB

Holzer.exe

IMPHASH b06fc75acce8d89c0625facf40b66ff6
SHA256 cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce
MD5 c971c68b4e58ccc82802b21ae8488bc7
SHA1 7305f3a0a0a0d489e0bcf664353289f61556de77
SHA512 ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7
SSDEEP 3072:2EYGNIaWY/0kTKxIJXtJ0YCHiQtSetFITTTTTHvvvvvNKB:HN5TKvr9PuKB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\papps\source\repos\Holzer\Release\Holzer.pdb

kernel32

FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle GetConsoleCP LCMapStringW CompareStringW SetEnvironmentVariableA FreeEnvironmentStringsW GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer GetProcAddress CreateThread LoadLibraryA TerminateThread Sleep SetSystemTime DeleteVolumeMountPointA FindNextFileW GetCurrentProcess FindFirstFileW GetConsoleWindow ExitProcess CloseHandle CreateFileA WriteFile GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapAlloc CreateFileW

user32

SendInput GetCursorPos MessageBoxA EnableWindow ShowWindow SetCursorPos GetSystemMenu GetWindowRect GetDC SetWindowPos GetSystemMetrics VkKeyScanA DrawIcon GetCursorInfo SetWindowLongA ExitWindowsEx GetWindowLongA SetWindowTextA GetForegroundWindow LoadIconW GetDesktopWindow EnableMenuItem

gdi32

BitBlt SelectObject PatBlt StretchBlt PlgBlt CreateRectRgn CreatePen Rectangle SelectClipRgn Ellipse CreateSolidBrush CreateEllipticRgn

advapi32

AdjustTokenPrivileges OpenProcessToken RegCloseKey RegCreateKeyExW RegSetValueExW LookupPrivilegeValueW

shell32

ShellExecuteW

winmm

waveOutOpen waveOutReset waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader