main[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
main.exe
Size 5.4MB
Sample260517-qjdl3acv2q
SHA256 285c38e665af458a63ac3fbbd937d4822ad5e1e1fa8e34b2ea2fb7e98026bdfd
MD5 80cbcd881ce7adbbe6ae84490d9d9aa3
SHA1 c316fbe1b74be635e5ad38a931e46e8f4b776faf
SHA512 27c66cc55b517285f009eeb706d77e56ace24d9b4aa2fa90964261e408e0630545586ca0e5700485a9c1fbc5cff44d1027e17c725aca2dfa1be912d12c832a85
SSDEEP 49152:BJVwASO/Gtlq+K9YnaLbLmh1LICpAbzNAkLVIv5gHSwV8WHEG3NJoZdcCN2HvCvK:gabO4zIvCyt34ild6rzfEGvXa+
TLSH
T16E469EA9F5BD00D9E46AC1BDC2965227E772B81413B017CF5A649AF51F23AE00EBF740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
main.exe

File Explorer

main.exe

.exe 5.4MB

main.exe

IMPHASH 7af7b02571775782b2a9ddb72abeda8f
SHA256 285c38e665af458a63ac3fbbd937d4822ad5e1e1fa8e34b2ea2fb7e98026bdfd
MD5 80cbcd881ce7adbbe6ae84490d9d9aa3
SHA1 c316fbe1b74be635e5ad38a931e46e8f4b776faf
SHA512 27c66cc55b517285f009eeb706d77e56ace24d9b4aa2fa90964261e408e0630545586ca0e5700485a9c1fbc5cff44d1027e17c725aca2dfa1be912d12c832a85
SSDEEP 49152:BJVwASO/Gtlq+K9YnaLbLmh1LICpAbzNAkLVIv5gHSwV8WHEG3NJoZdcCN2HvCvK:gabO4zIvCyt34ild6rzfEGvXa+
TLSH
T16E469EA9F5BD00D9E46AC1BDC2965227E772B81413B017CF5A649AF51F23AE00EBF740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3603136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\azov dev\azov site\azovcc website\software\output\build\rel\main.pdb

wininet

HttpSendRequestA InternetCloseHandle InternetOpenA InternetConnectA InternetReadFile HttpOpenRequestA

kernel32

VirtualAllocEx VirtualFreeEx GlobalLock CloseHandle Process32Next DeleteFileA SetConsoleCursorInfo GetTempPathA Sleep Module32First OpenProcess GetVolumeInformationA SetConsoleWindowInfo SetEndOfFile WriteConsoleW HeapSize GetProcessHeap TerminateProcess GetProcessId Module32Next CheckRemoteDebuggerPresent IsDebuggerPresent GlobalUnlock CreateToolhelp32Snapshot GetConsoleWindow FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW HeapReAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree GetConsoleOutputCP FlushFileBuffers HeapAlloc SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter RtlCaptureContext GetCommandLineW GetCommandLineA SetCurrentConsoleFontEx GetConsoleCursorInfo GetStdHandle SetConsoleScreenBufferSize GetCurrentProcess SetConsoleTextAttribute Process32First SetEnvironmentVariableW LeaveCriticalSection GetModuleFileNameW IsProcessorFeaturePresent FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW CreateFileW SetStdHandle GetEnvironmentVariableW RtlVirtualUnwind GetFileType WriteFile GetLastError GetModuleHandleW GetProcAddress MultiByteToWideChar SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW VirtualProtect VirtualFree WideCharToMultiByte GetACP InitializeCriticalSection EnterCriticalSection RtlUnwind DeleteCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW GetSystemTime SystemTimeToFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess CreateThread ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler ReadFile

user32

SetLayeredWindowAttributes MoveWindow GetDC SetWindowPos MapVirtualKeyA FindWindowW MessageBoxA ReleaseDC SetForegroundWindow SetWindowTextA GetWindowLongA MessageBoxW GetUserObjectInformationW GetProcessWindowStation SetWindowLongA GetSystemMetrics keybd_event FindWindowA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject BitBlt

ole32

CLSIDFromString CreateStreamOnHGlobal GetHGlobalFromStream

ws2_32

htonl inet_addr WSAStartup gethostbyname select ntohs getsockopt getsockname ioctlsocket WSAGetLastError WSASetLastError send recv inet_ntoa gethostbyaddr getservbyport getservbyname closesocket connect setsockopt socket shutdown getpeername recvfrom sendto htons WSACleanup

crypt32

CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertEnumCertificatesInStore CertCloseStore CertOpenStore CertOpenSystemStoreW

gdiplus

GdiplusShutdown GdipCloneImage GdiplusStartup GdipDisposeImage GdipSaveImageToStream GdipFree GdipCreateBitmapFromHBITMAP GdipAlloc

advapi32

CryptDecrypt CryptGetProvParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW CryptGetUserKey RegisterEventSourceW CryptExportKey DeregisterEventSource

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

main.exe

wininet

kernel32

user32

gdi32

ole32

ws2_32

crypt32

gdiplus

advapi32

generic