perc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
perc.exe
Size 75KB
Sample260604-243bpsgw5t
SHA256 8f4a079a6d9ba52fb3b84ae3d7fa9f75d78aef03ee5e644efda13ec789bf3ced
MD5 1ed61b903d2c31c8b782eeacb845d899
SHA1 f21a06f4c28526d1f98fe77b8c425cd6633a32f7
SHA512 e72c11a8dfea8152a8b85bdf8eb66025ac4aed63bcb2f43d2ee4e06e2fe22e6fff8afbdc684f2613bcf0f4c5bdb7602d3357468464a83895a5b41f714a0b1006
SSDEEP 1536:SQX/V4VGW//tTIEXuPUTLILBjw3uLRQIuNheuIDE90Irhbg+FsczZ:SC/8NTIEXuPGLGBjweLRQIuNhk8hUP8
TLSH
T163730A1A896AA1ABD23DD678C6460E01FB61BC8A0395B3DB57412DD30E65ED4FF3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
perc.exe

File Explorer

perc.exe

.exe 75KB

perc.exe

IMPHASH 2a70789d8e80722060db62d889992699
SHA256 8f4a079a6d9ba52fb3b84ae3d7fa9f75d78aef03ee5e644efda13ec789bf3ced
MD5 1ed61b903d2c31c8b782eeacb845d899
SHA1 f21a06f4c28526d1f98fe77b8c425cd6633a32f7
SHA512 e72c11a8dfea8152a8b85bdf8eb66025ac4aed63bcb2f43d2ee4e06e2fe22e6fff8afbdc684f2613bcf0f4c5bdb7602d3357468464a83895a5b41f714a0b1006
SSDEEP 1536:SQX/V4VGW//tTIEXuPUTLILBjw3uLRQIuNheuIDE90Irhbg+FsczZ:SC/8NTIEXuPGLGBjweLRQIuNhk8hUP8
TLSH
T163730A1A896AA1ABD23DD678C6460E01FB61BC8A0395B3DB57412DD30E65ED4FF3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FormatMessageW GetLastError GetProcAddress LocalFree GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead VirtualAlloc HeapAlloc GetProcessHeap VirtualProtect RtlAddFunctionTable LoadLibraryA SetUnhandledExceptionFilter

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

winhttp

WinHttpSendRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpSetTimeouts WinHttpQueryHeaders WinHttpConnect WinHttpReadData WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpReceiveResponse

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __C_specific_handler _CxxThrowException __current_exception __std_terminate memcmp memcpy memmove memset __current_exception_context

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _set_fmode __stdio_common_vsprintf __p__commode __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_initterm_e __p___argc _initterm _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _set_app_type _errno terminate _seh_filter_exe _cexit _crt_atexit _register_onexit_function _exit _initialize_onexit_table _initialize_narrow_environment exit _configure_narrow_argv __p___argv

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

iswspace towlower strlen wcslen

api-ms-win-crt-convert-l1-1-0

wcstoul wcstoull

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale