Inseffra[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Inseffra.exe
Size 1.6MB
Sample260205-yan1fahw8a
SHA256 fe95ea649a3ae990386fdb88ae773c0cdfd36dc2b807e0f88da36a4b007d818a
MD5 7dfe415d4a1ceef01cfec3fe2a872dc0
SHA1 e08a6992c662464092985d38e3cf42ffccb64bbf
SHA512 5209fe0c9d3dc92f02f22c93cf1e39e9bac0d9715507180144110add02dd6730d0baa35bbf3ae54ce9b70293e8d779aff40e5b960fa36c57bb8169491094eb54
SSDEEP 49152:KPgWxEzOon/kAvnJeHr5cVvcIXUIcEFU1:exrHrYkqUIc3
TLSH
T11D759D57B2A445ACC46B9A7CC963AB1BE2723C152F2297D723D03A192F373C01B7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Inseffra.exe

File Explorer

Inseffra.exe

.exe 1.6MB

Inseffra.exe

IMPHASH 5bbbf65628cbd3f62dfd9583c2f7a41e
SHA256 fe95ea649a3ae990386fdb88ae773c0cdfd36dc2b807e0f88da36a4b007d818a
MD5 7dfe415d4a1ceef01cfec3fe2a872dc0
SHA1 e08a6992c662464092985d38e3cf42ffccb64bbf
SHA512 5209fe0c9d3dc92f02f22c93cf1e39e9bac0d9715507180144110add02dd6730d0baa35bbf3ae54ce9b70293e8d779aff40e5b960fa36c57bb8169491094eb54
SSDEEP 49152:KPgWxEzOon/kAvnJeHr5cVvcIXUIcEFU1:exrHrYkqUIc3
TLSH
T11D759D57B2A445ACC46B9A7CC963AB1BE2723C152F2297D723D03A192F373C01B7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

723152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

PlaySoundA timeBeginPeriod timeEndPeriod

wininet

InternetConnectA InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile HttpQueryInfoA HttpOpenRequestA InternetSetOptionA HttpSendRequestA

kernel32

GetTempPathA CloseHandle GetModuleHandleW WideCharToMultiByte GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GlobalAlloc GlobalLock GlobalUnlock OpenProcess QueryFullProcessImageNameA FindResourceA LockResource LoadResource GetComputerNameA ReadFile WriteFile PeekNamedPipe GetTickCount64 CreateFileA GetCurrentProcessId LoadLibraryA QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter GetFileSizeEx Process32First CreateFileW CreateToolhelp32Snapshot Process32Next SetFilePointerEx Beep MultiByteToWideChar GlobalFree GetLocaleInfoA VerSetConditionMask FreeLibrary EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetConsoleOutputCP FlushFileBuffers GetFileType ReadConsoleW GetConsoleMode UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext Sleep GetCommandLineA TerminateProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId GetFileInformationByHandleEx GetUserDefaultUILanguage GetModuleFileNameW GetCurrentProcess GetModuleFileNameA RtlUnwind ExitProcess GetLastError GetModuleHandleA CreateMutexA HeapReAlloc IsValidCodePage GetACP AreFileApisANSI CreateFile2 GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile GetCommandLineW GetFileAttributesExW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW

user32

MessageBoxW ShowWindow LoadImageW GetCursorPos FindWindowW SetForegroundWindow GetKeyState MonitorFromWindow ClientToScreen TrackMouseEvent SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode GetClipboardData MonitorFromPoint GetMonitorInfoA GetClassNameA GetMessageExtraInfo SetWindowDisplayAffinity MapVirtualKeyA mouse_event PostMessageA ScreenToClient SetCursorPos GetWindowThreadProcessId CallNextHookEx SetWindowsHookExA GetWindowTextA UnhookWindowsHookEx OpenClipboard CloseClipboard EmptyClipboard SetClipboardData SendInput LoadCursorA GetDC IsWindowVisible FillRect IsWindow GetCapture GetCursorInfo FrameRect EnumWindows SetLayeredWindowAttributes UpdateWindow SendMessageA GetWindowLongPtrA SetWindowLongPtrA ReleaseCapture InvalidateRect ReleaseDC GetWindowTextW DefWindowProcW LoadImageA MapVirtualKeyW DispatchMessageA GetWindowRect DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW GetKeyNameTextA GetAsyncKeyState GetKeyboardLayout ToUnicodeEx GetForegroundWindow TranslateMessage LoadIconW LoadIconA PeekMessageA PostQuitMessage FindWindowA

gdi32

TextOutW DeleteObject SetTextColor SetBkMode GetTextExtentPoint32W DeleteDC GetDeviceCaps BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject CreateSolidBrush

shell32

Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteA ShellExecuteExA

ole32

CoTaskMemFree

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey GetUserNameA

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

919KB

Virtual Size

919KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Inseffra.exe

d3d11

d3dcompiler_47

winmm

wininet

kernel32

user32

gdi32

shell32

ole32

advapi32

imm32

generic