secret[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

secret.exe
Size

914KB
MD5

4f8857943e21f91f45eb4e801511ac3a
SHA1

9d7ae94eddd6ae5a29cf864096805861ebf990f2
SHA256

1c44fdb0b82ebe7ff6e47815c3866a81ac2abed3e7ad6c5b6a076764fd264fec
SHA512

e12a5d3274f9493052484433f3a3d73183cba74c0d3cf53613a1a770f6c625401a7cca32155e85a159fa44085e998f3a66158809810f132f803aa2f5870461dd
SSDEEP

12288:qOtyE6lm5Q38hylltLBK1hCOXQ7RsgjfGfQOIWD/LQMBUNisxAyB:TyEXQ388BK1tyFDG4OIKkM2N5x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
secret.exe

Files

secret.exe
.exe windows:6 windows x86 arch:x86

b84ff456b1be00739af9236a1f17c2ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Games\source\plague loader\Release\DirectX9ImGuiDesktopApp.pdb

Imports

d3d9

Direct3DCreate9

kernel32

WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
GetProcAddress
QueryPerformanceCounter
Process32First
WriteProcessMemory
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32Next
CloseHandle
VirtualAllocEx
ExitProcess
CreateRemoteThread
VirtualFreeEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
GlobalFree
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
GlobalLock
GlobalAlloc
MultiByteToWideChar
ResetEvent

user32

DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
UnregisterClassA
PostQuitMessage
GetDesktopWindow
RegisterClassExA
UpdateWindow
SetCursor
GetKeyState
SetClipboardData
LoadCursorA
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCapture
SetCursorPos
GetForegroundWindow
GetClientRect
IsChild
ClientToScreen
GetCapture
ScreenToClient
ReleaseCapture

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_frequency
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

xinput1_3

ord2
ord4

urlmon

URLDownloadToFileA

vcruntime140

__current_exception_context
_except_handler4_common
_CxxThrowException
memmove
memcpy
memchr
memset
__std_exception_destroy
__current_exception
strstr
__std_terminate
__std_exception_copy
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_wassert
_controlfp_s
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_get_initial_narrow_environment
_exit
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
ftell
fwrite
fflush
__p__commode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
_set_fmode
fclose
fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise
floor
_libm_sse2_sin_precise
__setusermatherr
_libm_sse2_acos_precise
_libm_sse2_sqrt_precise
_CIfmod
ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 694KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b84ff456b1be00739af9236a1f17c2ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

msvcp140

imm32

xinput1_3

urlmon

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 166KB - Virtual size: 166KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 694KB - Virtual size: 694KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 166KB - Virtual size: 166KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 694KB - Virtual size: 694KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 8KB - Virtual size: 7KB