purge[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
purge.exe
Size 2.8MB
Sample260528-xhldvabw21
SHA256 92a2c4b5b511f9d4d41351ca7ca1fce76cc8f70cd44384012d7c508b5be02405
MD5 42f959c7cd428640542461dcd4c40353
SHA1 f39b1643d13650322346c0fb6eae7667778651ec
SHA512 d036f1aebd52e7602315039f3c8e416315135d6a0472c5b92dfcd15d4aff62640f01f09c8a1ed434a7740f7e7b01891a146fc4915f9dfb44189978f018e1167b
SSDEEP 49152:6sSYoIUiilsi2wuHHn2K8QTxjpjXw76/d1SF1tN+qvCvbQn9Hi:vEu2K8Ct/d1SF1tN+qvCvbO
TLSH
T134D59EC6B2A500E8C567D178C657A69BE77274140730AFDB23E0CA652F33BE16B7A701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
purge.exe

File Explorer

purge.exe

.exe 2.8MB

purge.exe

IMPHASH 6bfdaa42bb555dab4eb8566bfe14e7d5
SHA256 92a2c4b5b511f9d4d41351ca7ca1fce76cc8f70cd44384012d7c508b5be02405
MD5 42f959c7cd428640542461dcd4c40353
SHA1 f39b1643d13650322346c0fb6eae7667778651ec
SHA512 d036f1aebd52e7602315039f3c8e416315135d6a0472c5b92dfcd15d4aff62640f01f09c8a1ed434a7740f7e7b01891a146fc4915f9dfb44189978f018e1167b
SSDEEP 49152:6sSYoIUiilsi2wuHHn2K8QTxjpjXw76/d1SF1tN+qvCvbQn9Hi:vEu2K8Ct/d1SF1tN+qvCvbO
TLSH
T134D59EC6B2A500E8C567D178C657A69BE77274140730AFDB23E0CA652F33BE16B7A701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1696080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\JackF\Downloads\1777119601820-Purge\build\purge.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SetThreadPriority SwitchToThread K32GetProcessMemoryInfo CreateThread Module32Next VirtualAlloc Module32First GetCurrentProcess CreateFileA GetFileSizeEx ReadFile HeapAlloc DuplicateHandle GetModuleHandleA HeapFree InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW SetLastError OpenProcess FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection CreateToolhelp32Snapshot EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetTickCount MoveFileExW GetTickCount64 WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW ReleaseSRWLockShared AcquireSRWLockShared IsDebuggerPresent GetCurrentThreadId FormatMessageA GetLocaleInfoEx MapViewOfFile UnmapViewOfFile CreateFileW GlobalUnlock WideCharToMultiByte CreateDirectoryW VirtualFree FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetLastError CreateFileMappingA GetCurrentThread CreateFile2 AreFileApisANSI GetFileInformationByHandleEx CloseHandle GetProcAddress ReadProcessMemory GetCurrentProcessId VirtualQueryEx WriteProcessMemory VirtualProtectEx GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock SetThreadAffinityMask Sleep SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetProcessId

user32

IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture ReleaseCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow GetForegroundWindow SetCursorPos LoadCursorA GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData CloseClipboard OpenClipboard PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow GetMonitorInfoA GetWindowLongA SetWindowLongA ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW SetWindowPos DestroyWindow PostQuitMessage DispatchMessageA GetWindow GetCursorPos GetWindowThreadProcessId EmptyClipboard UpdateWindow keybd_event MapVirtualKeyA FindWindowA SendInput GetAsyncKeyState GetWindowRect

advapi32

CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteA

ole32

CoInitializeEx CoUninitialize

d3dcompiler_43

D3DCompile

msvcp140

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Xtime_get_ticks ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ _Thrd_yield ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z __crtLCMapStringA ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

crypt32

PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertGetNameStringW

winmm

timeBeginPeriod

ws2_32

getpeername getsockopt send WSACloseEvent WSACreateEvent WSAEventSelect closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop bind gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons connect getsockname WSAEnumNetworkEvents

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler wcschr _CxxThrowException memcpy memcmp memchr memmove memset longjmp strrchr __RTtypeid __std_type_info_compare strchr strstr __std_terminate __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_aligned_malloc malloc calloc free _callnewh _aligned_free realloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _errno _initialize_narrow_environment _configure_narrow_argv __sys_nerr _crt_atexit abort terminate system _register_thread_local_exe_atexit_callback _cexit _c_exit __p___argv __p___argc _beginthreadex _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe __sys_errlist

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell fputs _lseeki64 _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc feof setvbuf fgetpos __stdio_common_vsprintf_s fwrite _close _wopen fgetc fclose _fileno fflush _write fputc _read __p__commode _set_fmode fgets

api-ms-win-crt-convert-l1-1-0

strtof strtod strtol atof strtoll strtoul atoi wcstombs

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlock_file _fstat64 _lock_file _unlink

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

ceilf expf fmod sqrt atan2f __setusermatherr _fdclass fmodf sinf roundf sqrtf acosf _fdopen fmaxf tan cosf logf sin powf _hypotf

api-ms-win-crt-string-l1-1-0

wcslen strcat_s tolower strcspn strncpy strcmp strncmp wcspbrk strcpy_s _strdup wcsncpy strpbrk strlen wcsncmp strspn

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 _time64 strftime _localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_codepage_func _configthreadlocale ___lc_locale_name_func

Name

.text

Size

1.7MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

942KB

Virtual Size

942KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

143KB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

35B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

purge.exe

d3d11

kernel32

user32

advapi32

shell32

ole32

d3dcompiler_43

msvcp140

ntdll

dwmapi

imm32

crypt32

winmm

ws2_32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic