win_client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
win_client.exe
Size 985KB
Sample260602-ah84kshv2s
SHA256 c83e4edc6ed23c0cc5c152ccde038eba67e02fc3ba4d3280bc417dc896d164df
MD5 35ba1b6a865136c11824752933d7b972
SHA1 3db26dc681446d6698effc8eea596b31046d9642
SHA512 311f89895e56533c41ec39c5e809839df4a0da709c5a9b9be7633c18a43191ed0859f75f1e3c8a76b731ee7c22551098ba8f125b4398fdf3777ee837cb3fe377
SSDEEP 24576:NoGb9BV0IDd3kbJnFIXwS1rxugvPAAwDpw:NoGb9t3kbJ6ASUDp
TLSH
T140252A47E2A344ECC62BC17447A39772BA70B46942347E6E1E95D7322F20E605F6EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
win_client.exe

File Explorer

win_client.exe

.exe 985KB

win_client.exe

IMPHASH 2a5319ac24b4fd48796e061e0b8fac7b
SHA256 c83e4edc6ed23c0cc5c152ccde038eba67e02fc3ba4d3280bc417dc896d164df
MD5 35ba1b6a865136c11824752933d7b972
SHA1 3db26dc681446d6698effc8eea596b31046d9642
SHA512 311f89895e56533c41ec39c5e809839df4a0da709c5a9b9be7633c18a43191ed0859f75f1e3c8a76b731ee7c22551098ba8f125b4398fdf3777ee837cb3fe377
SSDEEP 24576:NoGb9BV0IDd3kbJnFIXwS1rxugvPAAwDpw:NoGb9t3kbJ6ASUDp
TLSH
T140252A47E2A344ECC62BC17447A39772BA70B46942347E6E1E95D7322F20E605F6EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject SetStretchBltMode StretchBlt

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GlobalLock GlobalUnlock InitializeCriticalSection LeaveCriticalSection LocalFree OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _get_osfhandle _fileno _fseeki64 _ftelli64 _lseeki64 _read _setmode _wfopen _write fclose fflush ungetwc fopen fputc fputs fread fwrite getc getwc putc putwc setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscmp wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

user32

CloseDesktop GetDC GetDesktopWindow GetSystemMetrics GetUserObjectInformationW OpenDesktopW OpenInputDesktop ReleaseDC SendInput SetCursorPos SetProcessDpiAwarenessContext SetThreadDesktop VkKeyScanW

ws2_32

WSACleanup WSAStartup closesocket connect htons inet_addr recv send socket

Name

.text

Size

781KB

Virtual Size

781KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

win_client.exe

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

user32

ws2_32

generic