Source[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Source.exe
Size 1.0MB
Sample250803-yk2dhsdp91
SHA256 ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
MD5 bcf5133c2659fa75113593437f7cea96
SHA1 45bfc1fbbed06977521f56c7f50718334dde208a
SHA512 87bbced99bd0e306f2043abf10ca4ea35b399e2e009b0f56167b2234850f7a4f9b153f4268124ad16c2591f372dc714236ce29fa0b2d9076bf46ba86d1cdee5d
SSDEEP 24576:gED5D/XozlQLna1sUZ1sU0uEf6EmCDFp39zZF:gEMGntU0U0uQ6E1FbV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Source.exe

File Explorer

Source.exe

.exe 1.0MB

Source.exe

IMPHASH f856c900aa2ff93a4f8f394c8d119049
SHA256 ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
MD5 bcf5133c2659fa75113593437f7cea96
SHA1 45bfc1fbbed06977521f56c7f50718334dde208a
SHA512 87bbced99bd0e306f2043abf10ca4ea35b399e2e009b0f56167b2234850f7a4f9b153f4268124ad16c2591f372dc714236ce29fa0b2d9076bf46ba86d1cdee5d
SSDEEP 24576:gED5D/XozlQLna1sUZ1sU0uEf6EmCDFp39zZF:gEMGntU0U0uQ6E1FbV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

412424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sss\Downloads\RAGZ-FN-CHEAT-BASE-made-by-Arian14123--main\x64\Release\Source.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetConsoleWindow GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA CreateFileW DeviceIoControl VirtualAlloc VirtualFree lstrcmpiA CreateToolhelp32Snapshot Process32First Process32Next Sleep InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentProcess IsProcessorFeaturePresent CloseHandle WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree CreateThread GetConsoleScreenBufferInfo GetCurrentThreadId UnhandledExceptionFilter TerminateProcess Beep IsDebuggerPresent SetUnhandledExceptionFilter GetStdHandle SleepConditionVariableSRW

user32

SetCursor LoadIconA FindWindowA SetWindowLongA UpdateWindow GetSystemMetrics GetAsyncKeyState SetLayeredWindowAttributes MessageBoxA GetWindowLongPtrA SetWindowLongPtrA OpenClipboard CloseClipboard SetClipboardData ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA TranslateMessage LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursorPos GetClipboardData GetClientRect EmptyClipboard TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow

gdi32

CreateSolidBrush

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

msvcp140

?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?xalloc@ios_base@std@@SAHXZ ?iword@ios_base@std@@QEAAAEAJH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Xtime_get_ticks ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtQuerySystemInformation

vcruntime140

memcpy __std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler __current_exception_context __current_exception strstr memset memchr memmove __std_terminate memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _get_initial_narrow_environment _initterm _initterm_e exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _invoke_watson terminate

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode __p__commode fclose fflush __stdio_common_vsprintf_s _fileno __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf ftell fseek _wfopen fread fwrite _isatty

api-ms-win-crt-filesystem-l1-1-0

_access remove

api-ms-win-crt-time-l1-1-0

_time64 _localtime64

api-ms-win-crt-string-l1-1-0

strcmp strlen wcslen strncpy tolower strncmp _stricmp

api-ms-win-crt-math-l1-1-0

powf atan2f acosf sinf pow asin atan2 tanf fmodf logf ceilf sqrtf log __setusermatherr cosf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

shell32

ShellExecuteW