SK[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SK.exe
Size 16.8MB
Sample260619-2d3jsacz9x
SHA256 298399e9219a56814537b88cb73b6bce46b83d523508c678890507e2d0990615
MD5 aed6f13283105863daed5d7e93df5f4b
SHA1 712aa33ebb81a279f0816b2b2289c02296b9db1e
SHA512 33c96ceaa31a7a1a93b9f3b5d70ec9e633f17d03a727843b2c0d0319f9be625adea11fdd9de04929414aa15f2e4592e5a64e910c57b5c0f567de52f720567386
SSDEEP 393216:u+t4Z40VbVBW3OQRGKaJpjY9uYZMsLrvt03pNtbdMdPNkW93moW0:uVzJDGOQkKaJpgBrvtI1KvWot
TLSH
T16207330F902E5671F27871B050D61D9BAFCEECFB6B5064B726970616892C0DCE72E386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SK.exe

File Explorer

SK.exe

.exe 16.8MB

SK.exe

IMPHASH dbe631e3b01e961631125302637f3bab
SHA256 298399e9219a56814537b88cb73b6bce46b83d523508c678890507e2d0990615
MD5 aed6f13283105863daed5d7e93df5f4b
SHA1 712aa33ebb81a279f0816b2b2289c02296b9db1e
SHA512 33c96ceaa31a7a1a93b9f3b5d70ec9e633f17d03a727843b2c0d0319f9be625adea11fdd9de04929414aa15f2e4592e5a64e910c57b5c0f567de52f720567386
SSDEEP 393216:u+t4Z40VbVBW3OQRGKaJpjY9uYZMsLrvt03pNtbdMdPNkW93moW0:uVzJDGOQkKaJpgBrvtI1KvWot
TLSH
T16207330F902E5671F27871B050D61D9BAFCEECFB6B5064B726970616892C0DCE72E386
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-convert-l1-1-0

mbstowcs wcstoul

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

__C_specific_handler wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fwrite puts

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp iswctype strlen strncmp wcscmp wcslen wcsncmp

kernel32

AddDllDirectory CloseHandle CreateDirectoryW CreateFileW CreateProcessW DeleteCriticalSection EnterCriticalSection FindResourceA FormatMessageA GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetShortPathNameW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LoadResource LockResource OpenProcess SetConsoleCtrlHandler SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WriteFile

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16.8MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SK.exe

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

shell32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic