INTERNAL[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
INTERNAL.exe
Size 74.1MB
Sample260620-3ek7kabs41
SHA256 f687079b26cf42014e67336251a5ed45a38295e60a9fab54cc36740eb54491c6
MD5 cbc3431d7304fbb64ef894b8e0e59c18
SHA1 c78894e56d481a48cf6c5bed2f62d2fa8b165e81
SHA512 2be1697b159680740b125fa3f481ddcb46a3852a184f5e074ace8366d9b689bfb5db9de8e0af150914f903a762cf55b3527ccbc77c4fb8723b8f1e89ead18739
SSDEEP 786432:bE3biGRN1+qbwewbkXXYTRpbP5Y3paTsuGFqMj0u1fb7:betr1cMgRpbKaAuGFqHu1
TLSH
T14C087C0163F83894E0B35734EB76C6F2CA75BC656625C10F1498F90B2F77A42BA26772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
INTERNAL.exe

File Explorer

INTERNAL.exe

.exe 74.1MB

INTERNAL.exe

IMPHASH be255f78845a8fd4901e905111a19643
SHA256 f687079b26cf42014e67336251a5ed45a38295e60a9fab54cc36740eb54491c6
MD5 cbc3431d7304fbb64ef894b8e0e59c18
SHA1 c78894e56d481a48cf6c5bed2f62d2fa8b165e81
SHA512 2be1697b159680740b125fa3f481ddcb46a3852a184f5e074ace8366d9b689bfb5db9de8e0af150914f903a762cf55b3527ccbc77c4fb8723b8f1e89ead18739
SSDEEP 786432:bE3biGRN1+qbwewbkXXYTRpbP5Y3paTsuGFqMj0u1fb7:betr1cMgRpbKaAuGFqHu1
TLSH
T14C087C0163F83894E0B35734EB76C6F2CA75BC656625C10F1498F90B2F77A42BA26772
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1318552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Nibir Ahmed\Downloads\IMGUI INTERNAL\IMGUI INTERNAL\examples\EXE\INTERNAL.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

AllocConsole IsDebuggerPresent VirtualQueryEx CheckRemoteDebuggerPresent QueryPerformanceFrequency ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA HeapDestroy HeapSize SetLastError FormatMessageA LocalFree EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI ReleaseSRWLockExclusive CreateRemoteThread GetModuleHandleW ReadProcessMemory ExitProcess DeleteCriticalSection GetLastError Sleep CreateToolhelp32Snapshot OpenProcess AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter GetFileSizeEx VirtualAllocEx SetUnhandledExceptionFilter GetProcAddress GetThreadContext ReleaseMutex CreateThread GetSystemInfo CloseHandle Process32FirstW Process32Next DeleteFileW GetLocaleInfoA GetModuleHandleA GetTickCount VerSetConditionMask FreeLibrary LoadLibraryA QueryPerformanceCounter WriteProcessMemory VirtualProtectEx Beep Process32First VirtualFree GetCurrentProcess WriteFile VirtualAlloc InitializeCriticalSectionEx WaitForSingleObject CreateFileW GlobalUnlock WideCharToMultiByte GetFileAttributesW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW GlobalLock GlobalFree GlobalAlloc IsProcessorFeaturePresent TerminateProcess VirtualFreeEx GetCurrentThread CreateFileA GetFileInformationByHandleEx Process32NextW MultiByteToWideChar

user32

TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetAsyncKeyState LoadCursorA GetMessageExtraInfo GetKeyState UpdateWindow FindWindowA GetDesktopWindow PostQuitMessage PeekMessageA LoadIconA TranslateMessage GetKeyboardLayout MoveWindow MessageBoxA SetWindowDisplayAffinity GetWindowLongA SetWindowLongA ShowWindow GetCursorPos GetActiveWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW GetForegroundWindow SetCapture SetCursor GetClientRect DestroyWindow GetWindowRect DispatchMessageA DefWindowProcW GetDC IsWindowUnicode OpenClipboard CloseClipboard ReleaseCapture SetCursorPos SetLayeredWindowAttributes SetClipboardData GetClipboardData EmptyClipboard

gdi32

GetPixel

advapi32

CryptDestroyHash LookupPrivilegeValueA AdjustTokenPrivileges CopySid GetLengthSid GetTokenInformation IsValidSid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptEncrypt CryptImportKey CryptDestroyKey CryptCreateHash CryptHashData OpenProcessToken

shell32

ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach _Query_perf_counter ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z _Cnd_do_broadcast_at_thread_exit ??0_Lockit@std@@QEAA@H@Z

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFileExistsA

wininet

InternetOpenA InternetOpenUrlW InternetReadFile InternetCloseHandle

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpConnect WinHttpSendRequest WinHttpOpen

ntdll

RtlLookupFunctionEntry NtRaiseHardError RtlAdjustPrivilege RtlCaptureContext RtlVirtualUnwind

normaliz

IdnToAscii

wldap32

ord33 ord30 ord200 ord32 ord35 ord79 ord301 ord27 ord26 ord143 ord45 ord22 ord41 ord217 ord46 ord211 ord60 ord50

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertFreeCertificateChain CertFindCertificateInStore CryptStringToBinaryA

ws2_32

select getsockname getsockopt htons connect ntohl gethostname sendto ntohs setsockopt socket recvfrom closesocket freeaddrinfo getaddrinfo recv send __WSAFDIsSet WSAGetLastError ioctlsocket listen htonl accept WSACleanup WSAStartup bind WSAIoctl WSASetLastError getpeername

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr longjmp memcpy memmove memset memchr strchr _CxxThrowException __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp strstr __std_terminate __std_exception_destroy memcmp __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode _lseeki64 __stdio_common_vsscanf fgets fwrite fputc feof fflush fputs fopen fclose _read _write _close _open __acrt_iob_func fread __stdio_common_vsprintf _wfopen __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 ftell fsetpos ungetc fseek setvbuf fgetpos __stdio_common_vfprintf fgetc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno abort _beginthreadex system strerror __sys_nerr _invalid_parameter_noinfo _resetstkoflw _invoke_watson _getpid _register_thread_local_exe_atexit_callback _c_exit exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _wassert

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strncpy tolower strcspn strncmp strcpy_s strspn isupper _strdup strlen wcslen _stricmp strpbrk strcmp

api-ms-win-crt-heap-l1-1-0

realloc _callnewh calloc _msize free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtol atof atoi strtoul strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _access _unlink _stat64 _fstat64 _lock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

powf _dclass fmodf cosf ceilf sinf logf atan2f acosf sqrtf __setusermatherr

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64