Traceless[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Traceless.exe
Size 4.2MB
Sample260516-crdedah161
SHA256 128e13028f0f931d794f10374cbfdc1a550fc4590640e70763b941e09635c309
MD5 9d198fba674f7ad4385ef51ee241d79e
SHA1 63f856cb2ff834b82782386b43858672c1f46037
SHA512 2dc37dcc2e019f6326dc21e276104b46a79091c3953d9d2d0b190e314a5ca684df976f3f990744e8423616f453c419cf060c591f318528f4df34d0ec5bd8da14
SSDEEP 49152:Z9CP5SRb4y3VLuxuMvAKrTZrNyAk2dEzkhT8pLP0IDugq1NTxoPCdIA1sITLl3oD:Z86jVqxdAGTZ10taXxon2CIttYzP
TLSH
T11316F1A9E15B5358CF568F3854227A23E1B13CCA47F0C3D77ACDA9A06B5B4B4993CB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Traceless.exe

File Explorer

Traceless.exe

.exe 4.2MB

Traceless.exe

IMPHASH ca81f5a8da9d5c367a64ed51a0bc1901
SHA256 128e13028f0f931d794f10374cbfdc1a550fc4590640e70763b941e09635c309
MD5 9d198fba674f7ad4385ef51ee241d79e
SHA1 63f856cb2ff834b82782386b43858672c1f46037
SHA512 2dc37dcc2e019f6326dc21e276104b46a79091c3953d9d2d0b190e314a5ca684df976f3f990744e8423616f453c419cf060c591f318528f4df34d0ec5bd8da14
SSDEEP 49152:Z9CP5SRb4y3VLuxuMvAKrTZrNyAk2dEzkhT8pLP0IDugq1NTxoPCdIA1sITLl3oD:Z86jVqxdAGTZ10taXxon2CIttYzP
TLSH
T11316F1A9E15B5358CF568F3854227A23E1B13CCA47F0C3D77ACDA9A06B5B4B4993CB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

589400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

CloseServiceHandle PrivilegeCheck SetTokenInformation SetThreadToken CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetEntriesInAclW AllocateAndInitializeSid OpenSCManagerW RevertToSelf RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW GetTokenInformation

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent AreFileApisANSI GetLocaleInfoEx GetFileAttributesExW WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize FindNextFileW CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA FreeLibrary Module32FirstW Module32NextW SetConsoleTextAttribute GetStdHandle FreeConsole ExitProcess GetConsoleWindow AllocConsole SetConsoleTitleW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW UnhandledExceptionFilter FindFirstFileExW ReadProcessMemory GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW SetUnhandledExceptionFilter FormatMessageA FindClose Sleep FindFirstFileW WakeAllConditionVariable

user32

CallNextHookEx MapWindowPoints SetWindowDisplayAffinity MoveWindow SetWindowsHookExW DefWindowProcW GetSystemMetrics SetWindowLongW PostMessageW SetForegroundWindow GetKeyState GetMessageExtraInfo GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture GetWindowLongW TranslateMessage GetDesktopWindow SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DestroyWindow GetAsyncKeyState DispatchMessageW PeekMessageW

gdi32

GetPixel

shell32

SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

shlwapi

PathStripPathW

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception __std_exception_destroy __std_exception_copy strchr strstr memcmp memchr memcpy memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsscanf _wfopen __stdio_common_vfprintf fseek ftell freopen_s __acrt_iob_func _set_fmode fflush fclose __stdio_common_vsprintf fgetc __p__commode fwrite _get_stream_buffer_pointers _fseeki64 fgetpos fread fsetpos ungetc setvbuf fputc __stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

free realloc _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

towlower strcpy_s strncmp strncpy _wcsicmp tolower wcscpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _c_exit _configure_wide_argv _register_thread_local_exe_atexit_callback terminate _invoke_watson _set_app_type _beginthreadex exit _seh_filter_exe abort _cexit _crt_atexit _wsystem _exit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

fmodf acosf sqrtf sqrt atan2f ceilf __setusermatherr cosf logf pow sinf powf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func