meow[.]exe | Triage™

General

Target
meow.exe
Size 328KB
Sample260608-xplcese13r
SHA256 113ffb25b031a75d1397fbe6f3cf4496cc15db8c0150513c07b9a5ea090fb4c9
MD5 e19bb1089f583bac6d2c1933bc62675c
SHA1 54a98eed745527362cd6a851c6d2f2472ccfbd7f
SHA512 b5ed73d844334ad0da74de7b06634014cda03eb76d1419c0182b31155440776f2da68ebb7692b3ecc9a522959e3d91fb4904c33f5fe7ff7cf54869df1228ef00
SSDEEP 6144:f4Oi7rsAO/bMd+ui2pWAic3oh/DIDuHlvCK4TKYFaAIlJ+XniCOB:c+ODpWlcRDu8KBYgRCOB
TLSH
T19864C019BAA50CFAE5778035CE524906EA737C4247A0EBDF179007E68F276D05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meow.exe

File Explorer

meow.exe

.exe 328KB

meow.exe

IMPHASH 21622d5b58c529039815f43210ffeebe
SHA256 113ffb25b031a75d1397fbe6f3cf4496cc15db8c0150513c07b9a5ea090fb4c9
MD5 e19bb1089f583bac6d2c1933bc62675c
SHA1 54a98eed745527362cd6a851c6d2f2472ccfbd7f
SHA512 b5ed73d844334ad0da74de7b06634014cda03eb76d1419c0182b31155440776f2da68ebb7692b3ecc9a522959e3d91fb4904c33f5fe7ff7cf54869df1228ef00
SSDEEP 6144:f4Oi7rsAO/bMd+ui2pWAic3oh/DIDuHlvCK4TKYFaAIlJ+XniCOB:c+ODpWlcRDu8KBYgRCOB
TLSH
T19864C019BAA50CFAE5778035CE524906EA737C4247A0EBDF179007E68F276D05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SystemParametersInfoW MessageBoxW

shell32

ShellExecuteExW ShellExecuteA

advapi32

AllocateAndInitializeSid RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges CheckTokenMembership FreeSid

kernel32

HeapSize HeapReAlloc WriteConsoleW GetSystemTimeAsFileTime GetConsoleMode GetEnvironmentVariableW CreateFileW GetDriveTypeW GetFileSizeEx GetLogicalDriveStringsW ReadFile WriteFile GetTempPathW CloseHandle GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThreadId GetCurrentProcessorNumber GetTickCount64 GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW MoveFileExW LocalFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetConsoleOutputCP RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo GetStdHandle HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetStringTypeW SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers

Name

.text

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

meow.exe

user32

shell32

advapi32

kernel32

generic