n7ti6i7Q[.]exe | Triage™

General

Target
n7ti6i7Q.exe
Size 655KB
Sample260522-kdnbesay21
SHA256 b8233ef242d3969dbdcaf09ce633535228bfdee59a0ff59102f6a0d3055aed7a
MD5 aab243617365d13a13567bca61063d37
SHA1 0181c85f9a4d96c3dc57f28bb60a61a5bb27272e
SHA512 37a36523305420c2268084b0f140ae6ec7d469a4b834f10f707b0de92ac8958e98d7a335c3824a168035c5e73d0d9d2d9448bbed547a5dadfbdddc825b5b4e87
SSDEEP 6144:vsW7OzpPId26dQcEaUrPvwgwkRVagRoOQTiHaQsVIlVtpuf2mmP:hIId79EaUTvwieMowXPG2tP
TLSH
T16CE41A18EAA70235ECF1E67F94B15316D87138465B30CACB4242D7AA2EF76D5D432B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
n7ti6i7Q.exe

File Explorer

n7ti6i7Q.exe

.exe 655KB

n7ti6i7Q.exe

IMPHASH 47f7f360a91f7c55272a527a2e4d463a
SHA256 b8233ef242d3969dbdcaf09ce633535228bfdee59a0ff59102f6a0d3055aed7a
MD5 aab243617365d13a13567bca61063d37
SHA1 0181c85f9a4d96c3dc57f28bb60a61a5bb27272e
SHA512 37a36523305420c2268084b0f140ae6ec7d469a4b834f10f707b0de92ac8958e98d7a335c3824a168035c5e73d0d9d2d9448bbed547a5dadfbdddc825b5b4e87
SSDEEP 6144:vsW7OzpPId26dQcEaUrPvwgwkRVagRoOQTiHaQsVIlVtpuf2mmP:hIId79EaUTvwieMowXPG2tP
TLSH
T16CE41A18EAA70235ECF1E67F94B15316D87138465B30CACB4242D7AA2EF76D5D432B32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

379816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

DpInst.pdb

r8s9xly

YqSQoVqiOBDA JrXqmfStPAyb hCiUDfByadBYgO RNKgyZUtO LUZOBPiHAnLdsW hrFMoCto rTkbybiEwvMR QWjwAKvIBMpkrq ngvKJzAKJPyX sKRZlcxxPoZcBq WBsmqYwmxPqIjQ erHkTIyOfJaZEHXBmA RykKHJFxTJchScEWaMlRyOiUexA zaYEQLeEllMwIajEWrIpYKFC INYuptcgiZy pDFgSmekfrb wYHpEQkEpkzXBjRrpcz oyhzXPZSMDSjr oNfxEvKWHQrLd NYbppKTCViNbGF PCePh CFAAsmTZWlpHaYdcMZ EeWBmNnqapC zfIkNsavKtrVup CLPCofkHYagCWY RKHQRWRYh UBBosOqiPYgdOTLtoV deXVWJwGduDTpNBY hSauoOlpd wviwuxHaTfzad xpCKuqshSSUMnO ECuPodMX WsTHIwnqqyMENT YjLPVtMN jjorfypruuUfScH dJAoYZsIOXMkjKMbjnEJpCZeGb AlYphElljfRlGzNqBs ojfIQspxxKTE VPGnlUxzsWgGBJlLoVumdwTw ULPfZQbkJvuDvSngWQRmx xZwjDoNtOYxU VYzDxNAVLCvI hWrtTfpb OdELFpNvGRcE LytOylWynROCtyT BNBVzAZpSMngtoByEa NVathOUWULoSrJNMWAy qQMswdAivkYbiKcQGsw VUcPYRMBFHrQYNDfLZiT TqXwDozREICYmiaOsKCkPcHzCT VxwGnfFDLKyVFkomZ hWdHJYTXImPYlWok jEtyImBuxBT IGDmfrcIzRvQSTsc uXaqFKykwstXUNXS sVjdeibwOect odWQSqtOZLvFfb sfxQNVgBkZRQmB AhyKrJjvLDppoOewFiLbjgIJIo pJZDmUahALS AmaZKQUqmZlEVTGZcISwCmpm mWkLqLyNlaERqwnS TdPKabfEMtQuGWeLwpiYlDv JFExNXWKEajlurZHnXJ kIyGiXZXcQfLzYExiD GSaqyehivVsE eGxxVSwyHpiUNSbdoWLnyEc bDeigJUZbvLtteob zkOjOvkvVcJbHsKjssnFQTYvoHo CjhUPftJrEAHkXTSvK KfboecffMHBZNBU NMDvYDTyKZlpnCuMROuIBxt xBuwYIGKx EuGnzGjGVzckj rUfwhCUdrCdWKVRWAofLv IuXxoWQszxWAxMhkKWUdGKYSu TxHbDAcMZmGyYUaFAQsC hKgZLaYRDhLfsYFNuXoA IwOkDrtJ GqFjUPvGqDC zxJLZhngFkX keXJUIJMVbf xxoMHxhCtjQU kvfbsmwWbevOpgP KaeohIQOoqMoKxu YyTwvlYnP ygoXlIlXOJk GjsfCWYnFwuMSkT BLQLCVUkcXLHL pVpLSRRQzuXd BHkWyKvlSqSo SRsBtEKFHoAjCa JsGlbDIoRlMWHPRkska XWevHuOuYvwyaPxWu xGliGpSEbKhVb jpCwUrMJPVvk qPnOhHAvoPbQpWZRzevN xmMgeOjevodyaBHmtkRC PIwrGFjAUyrqWVwAgKpeUjXm XKnntKoaMfvbFneOvpUeSl koCmzeMJmtInrKFOJI ZCynnMSgGGMHCwKKrm hpJYeTFZEQmywVqTiRg bBbAwXjLV CJqtYaFSGn KhFbvFxdME ZVkJlqEHfHDf ynoorpXPWksFNIj zyJEuQFzurv rmNEKqRWENous

msvcrt

_wcmdln exit _cexit _exit _XcptFilter __wgetmainargs _resetstkoflw __C_specific_handler memset _wcsupr _wcslwr _errno __CxxFrameHandler fread _initterm fclose fwprintf _wfopen realloc ??2@YAPEAX_K@Z wcsstr _wcsicmp _wtol _vscwprintf free malloc ??_V@YAXPEAX@Z ??3@YAXPEAX@Z _amsg_exit __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit ??1type_info@@UEAA@XZ memcpy memmove _CxxThrowException mbtowc __mb_cur_max isleadbyte _iob _snprintf _itoa ferror __badioinfo __pioinfo _fileno _lseeki64 _write _isatty _wcsnicmp _vsnwprintf wcsncmp bsearch ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z iswalpha ??_U@YAPEAX_K@Z wcschr wcspbrk wcsrchr iswdigit feof memcmp

ntdll

NtQueryInformationToken RtlNtStatusToDosError NtClose NtOpenThreadToken RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtOpenProcessToken

shell32

ord59 CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

Sharing