squid[.]lol[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
squid.lol.exe
Size 557KB
Sample260527-rbq3vsft8l
SHA256 01daf5e73ecab451645ff16d572f7a1535db2689be628cae7017414f683d5ed5
MD5 5eba78909cc9f93c5145c7b0c324e9a5
SHA1 2579ee88adc849e99a8a18a9df60a9727e18c620
SHA512 c08da3bb3cbedb576d0dc9fa521d2ae34729ae821d2e7ebe2ad6c017f604d80d96a300ab5d3f0deefb85b8cb0500eb4ba649d3f320a05398aa80f3955ab82e74
SSDEEP 12288:PdIMQygx0dbH7KgSB2UsuEc95sdgmYiGnt1:PdAygSp82cEWsdgBiGnt1
TLSH
T195C4AE46B1F952F8C06FE174E686A61FFA763808076045DB23E449992FE37E157BA303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
squid.lol.exe

File Explorer

squid.lol.exe

.exe 557KB

squid.lol.exe

IMPHASH 4e0d6727668bcaf074b247fef83d38a8
SHA256 01daf5e73ecab451645ff16d572f7a1535db2689be628cae7017414f683d5ed5
MD5 5eba78909cc9f93c5145c7b0c324e9a5
SHA1 2579ee88adc849e99a8a18a9df60a9727e18c620
SHA512 c08da3bb3cbedb576d0dc9fa521d2ae34729ae821d2e7ebe2ad6c017f604d80d96a300ab5d3f0deefb85b8cb0500eb4ba649d3f320a05398aa80f3955ab82e74
SSDEEP 12288:PdIMQygx0dbH7KgSB2UsuEc95sdgmYiGnt1:PdAygSp82cEWsdgBiGnt1
TLSH
T195C4AE46B1F952F8C06FE174E686A61FFA763808076045DB23E449992FE37E157BA303
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

449372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0tuna\Desktop\squid.lol\x64\Release\squid.lol.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

SetThreadPriority GetCurrentThread GetTickCount OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetConsoleTitleA ExitProcess GetConsoleWindow SetConsoleOutputCP Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next ReadProcessMemory ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead Sleep CloseHandle WriteProcessMemory

user32

DestroyWindow GetSystemMetrics GetCursorPos SetWindowLongA DispatchMessageA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow ShowWindow DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA FindWindowA GetAsyncKeyState ScreenToClient SendInput SetClipboardData GetClipboardData EmptyClipboard IsWindowUnicode CloseClipboard GetClientRect SetCursor SetCapture GetForegroundWindow ReleaseCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture SetCursorPos OpenClipboard

shell32

ShellExecuteW

msvcp140

_Thrd_yield _Mtx_unlock _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Query_perf_counter _Thrd_detach

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memmove __current_exception_context __current_exception __C_specific_handler memset memcpy memcmp memchr strchr __std_terminate __std_exception_destroy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_exit _invoke_watson __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _beginthreadex _get_initial_narrow_environment terminate _set_app_type _seh_filter_exe _cexit exit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s _wfopen __p__commode ftell __acrt_iob_func __stdio_common_vsscanf fread __stdio_common_vsprintf fseek fwrite fflush __stdio_common_vfprintf fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp _stricmp strcmp strncpy

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

pow logf log powf sqrtf atan2f ceilf cosf __setusermatherr acosf fmodf sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale