visual[.]exe | Triage™

Target
visual.exe
Size 12.2MB
Sample250521-ch6dsseq7s
SHA256 ef12d7c8167d4fe2d79a8faf27c2c681801e1d72f7ee2c8836ee665a78390a50
MD5 a6de62fc30088488d483b7f88893e62c
SHA1 26e5752bdf7406cd554403afb4d969ceb1cc380e
SHA512 9439d997290dd91a7c736db32ad1d4cc50437e96b3999ae62b7afd957736c828a3d20080a453384d2ca4ee474bc37ab41af75ddda45eea9fb9ee883de5f93d10
SSDEEP 98304:8xJmTXY7HrDPO7cbCYX3hwWAe0hb9fTTrADkS8KZR+Mk4PcE9ORt50:8xJJPCcbCC3hZqhxTrADkS8m/kIQtK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
visual.exe

File Explorer

visual.exe

.exe 12.2MB

visual.exe

IMPHASH 861820c57fef8559a790f8f59c2f087b
SHA256 ef12d7c8167d4fe2d79a8faf27c2c681801e1d72f7ee2c8836ee665a78390a50
MD5 a6de62fc30088488d483b7f88893e62c
SHA1 26e5752bdf7406cd554403afb4d969ceb1cc380e
SHA512 9439d997290dd91a7c736db32ad1d4cc50437e96b3999ae62b7afd957736c828a3d20080a453384d2ca4ee474bc37ab41af75ddda45eea9fb9ee883de5f93d10
SSDEEP 98304:8xJmTXY7HrDPO7cbCYX3hwWAe0hb9fTTrADkS8KZR+Mk4PcE9ORt50:8xJJPCcbCC3hZqhxTrADkS8m/kIQtK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7776800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

visual.pdb

ntdll

RtlGetVersion NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateFile

kernel32

IsProcessorFeaturePresent RtlPcToFileHeader RaiseException IsDebuggerPresent GetCurrentThreadId EncodePointer CreateMutexA WaitForSingleObjectEx TlsAlloc CreateThread WideCharToMultiByte InitializeSListHead MultiByteToWideChar UpdateProcThreadAttribute InitializeProcThreadAttributeList GetUserDefaultUILanguage GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable LoadLibraryW CopyFileExW GetFinalPathNameByHandleW DeviceIoControl RemoveDirectoryW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW FreeLibrary MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW GetFileInformationByHandleEx FindClose FindNextFileW ReleaseMutex HeapReAlloc QueryPerformanceFrequency TerminateProcess SleepEx WriteFileEx GetCurrentProcessId GetStdHandle AcquireSRWLockExclusive ReleaseSRWLockExclusive SetFilePointerEx DuplicateHandle GetCurrentProcess SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo TlsSetValue lstrlenW QueryPerformanceCounter WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThread GetProcAddress SetThreadStackGuarantee AddVectoredExceptionHandler LoadLibraryA CompareStringOrdinal DeleteProcThreadAttributeList LoadLibraryExA FreeEnvironmentStringsW GetModuleHandleW HeapAlloc TlsGetValue GetConsoleMode GetTempPathW LCIDToLocaleName CreateProcessA GetEnvironmentVariableW UnhandledExceptionFilter GetFileAttributesW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter RtlUnwindEx GetFileInformationByHandle Sleep GetModuleHandleA CloseHandle CreateProcessW FormatMessageW TlsFree DeleteCriticalSection WriteConsoleW CreateFileW

user32

TranslateMessage GetMenuBarInfo PostQuitMessage TrackPopupMenu CheckMenuItem SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DispatchMessageW DestroyAcceleratorTable CreatePopupMenu CreateMenu DestroyMenu RemoveMenu PostThreadMessageW MapVirtualKeyW DrawMenuBar SetMenu DrawIconEx GetMenuItemInfoW IsIconic ToUnicodeEx SystemParametersInfoA SetPropW IsWindowVisible GetMenu GetRawInputData CreateIcon SendInput SetForegroundWindow EnumChildWindows SetWindowPos GetWindowTextW DefWindowProcW ClientToScreen ChangeDisplaySettingsExW GetWindowTextLengthW SetWindowTextW MonitorFromPoint EnumDisplayMonitors CreateWindowExW OffsetRect DestroyIcon SetWindowDisplayAffinity ClipCursor GetClipCursor GetMessageW SetWindowLongW EnableMenuItem GetSystemMenu MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SystemParametersInfoW PeekMessageW SetWindowPlacement GetWindowPlacement InvalidateRgn ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx LoadCursorW SetCursor RegisterRawInputDevices RegisterClassExW RedrawWindow SetParent MapWindowPoints GetWindow RegisterWindowMessageA SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW SetWindowRgn FindWindowExW IsWindowEnabled EnableWindow AdjustWindowRect TranslateAcceleratorW GetKeyboardLayout PostMessageW DispatchMessageA GetMessageA SendMessageW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent FillRect DestroyWindow MonitorFromRect GetClientRect GetWindowLongW ScreenToClient DrawTextW GetWindowDC GetForegroundWindow SetCursorPos RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect ShowCursor

ole32

CoInitializeEx CoTaskMemAlloc CoInitialize OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler RevokeDragDrop CoTaskMemFree CoUninitialize CoCreateInstance

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

gdi32

DeleteObject CombineRgn CreateRectRgn SetTextColor CreateSolidBrush BitBlt CreateCompatibleDC DeleteDC GetDeviceCaps CreateDIBSection SelectObject SetBkMode

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath DragQueryFileW SHOpenFolderAndSelectItems DragFinish ILCreateFromPathW SHCreateItemFromParsingName SHAppBarMessage ShellExecuteExW ILFree

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

bcryptprimitives

ProcessPrng

advapi32

EventRegister EventUnregister EventSetInformation EventWriteTransfer RegOpenKeyExW RegGetValueW RegCloseKey RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

pow round roundf trunc floor __setusermatherr

api-ms-win-crt-string-l1-1-0

wcsncmp wcslen strcpy_s wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_c_exit __p___argv _register_thread_local_exe_atexit_callback __p___argc _exit exit _initterm_e _configure_narrow_argv _initialize_narrow_environment _seh_filter_exe _set_app_type abort _initterm _get_initial_narrow_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh calloc free _set_new_mode malloc

Resubmissions

Sharing

General