5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5.exe
Size 1.5MB
Sample250115-pllvsasmgt
SHA256 2117a22f49cc2ec80da587c770f589b16a9cbcae1a02f4758d7319535a2304d6
MD5 b76ccdfafe317d9c2924802e20f2b4ce
SHA1 8600f2913517897f66948bdd65d3394e4f22f580
SHA512 8f719e390edb8afd08ed4fec71adf915515b16b23f1e98214554096fc5a7d6170781a88d9f1c47f8476df9167e0b519761677b51184218f41adf98fa098c4538
SSDEEP 24576:xw75+IDGhAW4lGEJToUJo60OegX7AoNi70okHxus1mu1AUd0c9DMblbcioxcKK26:xw3DGhAW2x0Erv070J9DMbJcioxcKK26
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5.exe

File Explorer

5.exe

.exe 1.5MB

5.exe

IMPHASH a581beaeb64ebfff7589a4ac629f3dc1
SHA256 2117a22f49cc2ec80da587c770f589b16a9cbcae1a02f4758d7319535a2304d6
MD5 b76ccdfafe317d9c2924802e20f2b4ce
SHA1 8600f2913517897f66948bdd65d3394e4f22f580
SHA512 8f719e390edb8afd08ed4fec71adf915515b16b23f1e98214554096fc5a7d6170781a88d9f1c47f8476df9167e0b519761677b51184218f41adf98fa098c4538
SSDEEP 24576:xw75+IDGhAW4lGEJToUJo60OegX7AoNi70okHxus1mu1AUd0c9DMblbcioxcKK26:xw3DGhAW2x0Erv070J9DMbJcioxcKK26
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

781936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\luis\Desktop\@ siege v4\release\siege v4.pdb

kernel32

FreeLibrary FormatMessageA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency VerSetConditionMask QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle OutputDebugStringA SetConsoleWindowInfo CreateFileA RaiseException LoadLibraryW GetThreadContext GetConsoleWindow GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThreadId GetTempPathW MoveFileA TerminateProcess GetModuleFileNameW GetFileAttributesA SetFileInformationByHandle SetFileAttributesA CreateToolhelp32Snapshot LoadLibraryExA CreateDirectoryA SetUnhandledExceptionFilter CreateFileW IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx DeviceIoControl Process32First GetLastError GetModuleFileNameA lstrcmpiA Process32Next Sleep VirtualAlloc GetCurrentProcess VirtualFree SetLastError GetCurrentThread GetCurrentProcessId GetProcAddress CloseHandle LoadLibraryA OpenProcess GetModuleHandleA UnhandledExceptionFilter

user32

GetClassNameW GetWindowLongA EnumWindows FindWindowW DispatchMessageA GetWindowRect DestroyWindow ShowWindow SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA GetCursorPos FindWindowA GetForegroundWindow GetAsyncKeyState ScreenToClient MessageBoxA PostMessageA GetWindowThreadProcessId SetClipboardData GetClipboardData MoveWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage PeekMessageA EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState UpdateWindow PostQuitMessage SendInput GetSystemMetrics RegisterClassExA UnregisterClassA

advapi32

RegQueryValueExA RegSetKeyValueW GetUserNameW RegOpenKeyExA RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW

shell32

SHGetFolderPathW ShellExecuteA

sentinal

s_init s_token s_get_username

msvcp140

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_lock _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlInitUnicodeString RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry NtQuerySystemInformation

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA InternetReadFile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy wcsstr strstr strchr longjmp strrchr __std_exception_destroy __C_specific_handler __current_exception __current_exception_context _CxxThrowException memset memcpy __std_terminate memchr memcmp memmove __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

realloc free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn strerror _errno _register_thread_local_exe_atexit_callback system _beginthreadex _c_exit __p___argv __p___argc _exit terminate exit _initterm_e _initterm _get_initial_narrow_environment abort _set_app_type _seh_filter_exe _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fgetc fclose fflush __acrt_iob_func fputc _set_fmode __stdio_common_vsscanf _wfopen fseek fgetpos setvbuf __p__commode ungetc tmpnam fwrite fsetpos fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf_s freopen ferror ftell fopen getc feof __stdio_common_vsprintf _ftelli64 fgets _popen tmpfile _pclose clearerr

api-ms-win-crt-string-l1-1-0

isspace isdigit strspn isalnum toupper strcmp strpbrk strcoll strncpy islower strncmp ispunct isxdigit isgraph _stricmp isupper tolower isalpha iscntrl

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-convert-l1-1-0

atof strtoull strtod strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file remove rename _wremove _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv setlocale ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _difftime64 clock _gmtime64 strftime _mktime64

api-ms-win-crt-math-l1-1-0

log log10 pow powf sin sinf fmod cos tan ldexp sqrtf ceil atan2f fmodf roundf floor atan2 exp sqrt asin cosf __setusermatherr acosf frexp _dsign ceilf acos

api-ms-win-crt-environment-l1-1-0

getenv