g | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
g
Size 544KB
Sample251201-ak94natjcl
SHA256 aa3e361da204814ad64fc500de97574ea79686683707ef8233497b6567375de0
MD5 d497b96d4e8298ebb35ecdf816bdc6df
SHA1 ab98acee9eaa3f9227c6f52ebb30a6a61641ca86
SHA512 40fbf01b7817f16c9f344eb4662483016414da6ed10eb8c5cfa002f013008e170df9706e96fc9ec81e9f44d35a8b0e31262f0cddf58d61d576da0d58dec3d548
SSDEEP 12288:Q7a3iwbihySLLvShBGA7XO3LWUOfr4Co:9+ggjy9EEfr4Co
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
g

File Explorer

g

.exe 544KB

g

IMPHASH f705b86a25188b412ade0f888fe196c8
SHA256 aa3e361da204814ad64fc500de97574ea79686683707ef8233497b6567375de0
MD5 d497b96d4e8298ebb35ecdf816bdc6df
SHA1 ab98acee9eaa3f9227c6f52ebb30a6a61641ca86
SHA512 40fbf01b7817f16c9f344eb4662483016414da6ed10eb8c5cfa002f013008e170df9706e96fc9ec81e9f44d35a8b0e31262f0cddf58d61d576da0d58dec3d548
SSDEEP 12288:Q7a3iwbihySLLvShBGA7XO3LWUOfr4Co:9+ggjy9EEfr4Co
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

385536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysStringLen VariantClear VariantCopy SysAllocString SysStringByteLen SysFreeString SysAllocStringLen

user32

CharUpperW

advapi32

LookupPrivilegeValueW GetFileSecurityW SetFileSecurityW RegOpenKeyExW RegQueryValueExW RegCloseKey AdjustTokenPrivileges OpenProcessToken

msvcrt

_c_exit _XcptFilter _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UEAA@XZ __C_specific_handler _beginthreadex _isatty memcmp memset strlen _exit wcscmp strcmp memmove fflush fputc fputs _iob fgetc free malloc __CxxFrameHandler _CxxThrowException memcpy _cexit __initenv exit __getmainargs _initterm __setusermatherr _commode _fmode __set_app_type wcsstr

kernel32

WaitForSingleObject ResumeThread SetThreadAffinityMask CreateEventW SetEvent InitializeCriticalSection GetVersion SetFileTime VirtualFree VirtualAlloc GetConsoleMode SetConsoleMode SetFileApisToOEM GetCommandLineW GetConsoleScreenBufferInfo SetConsoleCtrlHandler GetProcessTimes QueryPerformanceFrequency QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetProcessAffinityMask OpenEventW UnmapViewOfFile MapViewOfFile OpenFileMappingW GetStdHandle GetSystemTimeAsFileTime FileTimeToDosDateTime IsProcessorFeaturePresent GlobalMemoryStatusEx GetSystemInfo GetProcessAffinityMask FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime GetCurrentProcess GetDiskFreeSpaceW SetEndOfFile WriteFile ReadFile SetFilePointer GetLastError MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryExW LoadLibraryW GetModuleFileNameW LocalFree FormatMessageW CloseHandle CreateFileW VirtualProtect RemoveDirectoryW MoveFileW GetProcAddress GetModuleHandleW CreateDirectoryW DeleteFileW SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathW SetLastError GetCurrentProcessId GetTickCount GetCurrentThreadId GetFileInformationByHandle FindClose FindFirstFileW FindNextFileW GetModuleHandleA GetFileAttributesW GetLogicalDriveStringsW DeviceIoControl GetFileSize