tmppywdl52s[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tmppywdl52s.exe
Size 260KB
Sample260522-twprmsb16z
SHA256 d96898e27c1879c050f81940c8a26d60124e3c0657d3f231d4fe8b7c9409e6d6
MD5 0e5a48d682a9595a0cbfa7576686c563
SHA1 7daa5b4df2afd56b6a8aa0600558a2e061d5f412
SHA512 9c005129e238ef8ff2f5588985146586a3559f139a5e86b69e3ea494100b34191da9a272163ce420416043a478f7621fbf47d50076c91078ea53516e8c67c0dd
SSDEEP 6144:GAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:GoB7BsHQz8JmG0D
TLSH
T1A14412E5A5722EA7C42149B914ABE530317D4E463B92423FAFC0ACAF3CB35D5ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmppywdl52s.exe

File Explorer

tmppywdl52s.exe

.exe 260KB

tmppywdl52s.exe

IMPHASH f982bf68faea31fb085b9351d99b9619
SHA256 d96898e27c1879c050f81940c8a26d60124e3c0657d3f231d4fe8b7c9409e6d6
MD5 0e5a48d682a9595a0cbfa7576686c563
SHA1 7daa5b4df2afd56b6a8aa0600558a2e061d5f412
SHA512 9c005129e238ef8ff2f5588985146586a3559f139a5e86b69e3ea494100b34191da9a272163ce420416043a478f7621fbf47d50076c91078ea53516e8c67c0dd
SSDEEP 6144:GAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:GoB7BsHQz8JmG0D
TLSH
T1A14412E5A5722EA7C42149B914ABE530317D4E463B92423FAFC0ACAF3CB35D5ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42u

ord823 ord825

msvcrt

free _beginthread

atl

ord21 ord18 ord22 ord15 ord16 ord44 ord43 ord32 ord58 ord23

kernel32

GetVersionExW SetEvent WaitForSingleObject IsBadReadPtr GetNumberFormatW GetLocaleInfoW GetCurrentProcess InitializeCriticalSection lstrlenW GetModuleFileNameW lstrcpyW GetShortPathNameW GetModuleHandleW lstrcmpiW GetWindowsDirectoryW GlobalAlloc GetModuleHandleA GetLastError LoadLibraryW LoadLibraryA ExpandEnvironmentStringsW lstrcmpW GetCurrentThread lstrcatW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter MultiByteToWideChar lstrlenA LocalFree GetProcessHeap CreateEventW GetProcAddress

user32

SetWindowTextW SetFocus SendMessageW SetDlgItemTextW DialogBoxParamW SendDlgItemMessageW wsprintfW MessageBeep ShowWindow GetDlgItemInt EndDialog SetDlgItemInt LoadImageW SetCursor LoadCursorW ShowCursor IsWindow PeekMessageW SetWindowLongW PostMessageW EnableWindow GetDlgItemTextW LoadBitmapW IsDlgButtonChecked LoadIconW MessageBoxW WinHelpW GetSystemMetrics

advapi32

LookupPrivilegeValueW OpenThreadToken AdjustTokenPrivileges ImpersonateSelf RegOpenKeyW RegQueryValueExW GetUserNameW LookupAccountNameW RegEnumKeyExW RegSetValueExW RegOpenKeyExW GetTokenInformation RegDeleteKeyW RegCloseKey RegCreateKeyExW

oleaut32

SafeArrayGetLBound SafeArrayGetElement SysAllocStringByteLen VariantChangeType SafeArrayGetUBound SysStringByteLen VariantClear VariantInit SysStringLen SysAllocString SysFreeString

ole32

CoCreateInstance CoInitialize StringFromCLSID

gdi32

GetTextExtentPointW DeleteObject

shell32

ShellExecuteW

shlwapi

StrFormatByteSizeW

samlib

SamCloseHandle SamFreeMemory SamGetGroupsForUser SamSetMemberAttributesOfGroup SamiSetDSRMPasswordOWF SamCreateGroupInDomain SamGetAliasMembership SamEnumerateUsersInDomain SamGetDisplayEnumerationIndex

Name

.text

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Fq

Size

2KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SBYeOU

Size

110KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.MDnc

Size

2KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.oFOQE

Size

3KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QHZGU

Size

3KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kUM

Size

107KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmppywdl52s.exe

mfc42u

msvcrt

atl

kernel32

user32

advapi32

oleaut32

ole32

gdi32

shell32

shlwapi

samlib

generic