509[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
509.exe
Size 3.1MB
Sample260608-sfe2tsft8j
SHA256 5a3901076235eac54323469ebfe7b18731e952d097e681e3808bcbe1aba1e8e3
MD5 e30dc3242d30fc153e605c5901e34685
SHA1 1937f49e89a8ef7759e5b0e31b91e15014b4d600
SHA512 6ba4226bea831efa49412edddb247428510eab1dce58f868cb7c1bed6d5f987dfd15d866bb7781eb4530cf56ea792d2522f5da815ead6d21115202d054b3eefd
SSDEEP 49152:InNg9o0a8w5uiQzlynZdKETupSAl0axM7IBTY0ErvqngS41ZHSqBXA/FJR9+5DZr:I6niQzlynZdKECSI0mG1Zy39n9+Z
TLSH
T18AE5D00BA2A102E8C1A7D678CA579317F372784D073086E773E49AB55F636E41B3BB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
509.exe

File Explorer

509.exe

.exe 3.1MB

509.exe

IMPHASH 14b1bd5a49f6735ae8d76810140c1287
SHA256 5a3901076235eac54323469ebfe7b18731e952d097e681e3808bcbe1aba1e8e3
MD5 e30dc3242d30fc153e605c5901e34685
SHA1 1937f49e89a8ef7759e5b0e31b91e15014b4d600
SHA512 6ba4226bea831efa49412edddb247428510eab1dce58f868cb7c1bed6d5f987dfd15d866bb7781eb4530cf56ea792d2522f5da815ead6d21115202d054b3eefd
SSDEEP 49152:InNg9o0a8w5uiQzlynZdKETupSAl0axM7IBTY0ErvqngS41ZHSqBXA/FJR9+5DZr:I6niQzlynZdKECSI0mG1Zy39n9+Z
TLSH
T18AE5D00BA2A102E8C1A7D678CA579317F372784D073086E773E49AB55F636E41B3BB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1531016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\My Src\7mnyst1 Applcation Src\7mnyst1 Applcation Src\x64\Release\7mnyst1 Optimizer.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

advapi32

CryptCreateHash CryptDestroyKey CryptAcquireContextW CryptGenRandom OpenServiceA RegDeleteValueA RegEnumValueA SetSecurityInfo RegOpenKeyExA FreeSid RegSetValueExA ChangeServiceConfigA RegCreateKeyExA OpenSCManagerA AllocateAndInitializeSid RegQueryValueExA CloseServiceHandle RegCloseKey GetSecurityInfo CheckTokenMembership CryptReleaseContext CryptVerifySignatureW CryptGetHashParam CryptHashData CryptDestroyHash

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertEnumCertificatesInStore CryptImportPublicKeyInfo CertCloseStore CertOpenStore CryptStringToBinaryA CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine

ws2_32

WSAWaitForMultipleEvents socket WSACreateEvent ntohs WSAResetEvent htons WSAGetLastError WSAEventSelect ioctlsocket closesocket freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl setsockopt recv getsockname WSASetLastError getpeername connect getsockopt send bind WSAStartup accept WSACleanup WSACloseEvent WSAEnumNetworkEvents

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

kernel32

SetFileInformationByHandle AreFileApisANSI FindNextFileW FindFirstFileExW FindFirstFileW GetFileInformationByHandleEx GetFileAttributesExW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW CreateDirectoryW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter LoadLibraryW GetModuleHandleW GetConsoleWindow AllocConsole Sleep CreateDirectoryA GetSystemTimes GetEnvironmentVariableA WaitForSingleObject CreateFileW GetTempPathA GetLastError GetFileAttributesA CloseHandle GetWindowsDirectoryA SetFileAttributesA GetLocalTime GlobalMemoryStatusEx GetExitCodeProcess SetPriorityClass TerminateProcess CreateFileA LocalFree VerifyVersionInfoW CreateProcessA FindFirstFileA GetCurrentProcess K32GetModuleFileNameExW FindNextFileA FindClose UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetSystemInfo GetCurrentProcessId QueryFullProcessImageNameW K32EnumProcessModules MapViewOfFile IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThread CreateThread ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetTickCount GetFullPathNameW SetLastError MoveFileExW WaitForSingleObjectEx FormatMessageW GetFileSizeEx ReadFile CreateFileMappingA InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead HeapFree HeapAlloc LoadLibraryA GetDiskFreeSpaceExA

user32

EmptyClipboard CloseClipboard OpenClipboard GetClipboardData SetCursorPos ReleaseCapture IsWindowUnicode GetCursorPos GetWindowThreadProcessId IsWindowVisible EnumWindows GetClassNameW FindWindowA GetWindowTextW GetAsyncKeyState SendInput DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow ShowWindow GetWindowRect MoveWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture GetClientRect SetCursor SetClipboardData

shell32

SHGetFolderPathA ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeEx

oleaut32

SysAllocString VariantClear SysFreeString VariantInit

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vmprotectsdk64

VMProtectEnd VMProtectBegin

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Thrd_detach ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?rdstate@ios_base@std@@QEBAHXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

wininet

HttpQueryInfoA InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

pdh

PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryW PdhAddCounterW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove strchr memset memcpy __C_specific_handler strstr memcmp wcschr longjmp __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException strrchr memchr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_wfopen fwrite __stdio_common_vsprintf fputs __p__commode fread __stdio_common_vsscanf __stdio_common_vsnprintf_s _fileno _close _wopen fputc fflush feof ftell __stdio_common_vfprintf fseek fgetc fclose __acrt_iob_func _set_fmode _pclose _popen fgets fgetpos __stdio_common_vsprintf_s setvbuf ungetc _get_stream_buffer_pointers _fseeki64 fsetpos

api-ms-win-crt-runtime-l1-1-0

__sys_nerr _errno abort _beginthreadex __sys_errlist exit _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

tolower strpbrk strcpy_s towlower strspn strlen strncmp strcspn _strdup wcsncpy strcmp wcsncmp strncpy toupper

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh free _set_new_mode realloc

api-ms-win-crt-convert-l1-1-0

strtoll wcstombs atoi strtol strtoull strtod

api-ms-win-crt-math-l1-1-0

_dclass _fdopen powf __setusermatherr sinf fmodf cosf ceilf acosf sqrtf

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wstat64 _fstat64 _unlink _unlock_file _fullpath

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64