klr[.]exe | Triage™

General

Target
klr.exe
Size 265KB
Sample260620-ajabmsdv2t
SHA256 4ee3511d715d4177f36658adab6e8c5114d3e129a5a7b96c99cc469effab8616
MD5 47eb3099e6aea06f22c6037f7f1df663
SHA1 f821ca00c914443374f39704d157fccdeaf87775
SHA512 b9cbb86f59aad2f875e5cf04d8bbb153320d193b48e43d2a89d3bcc5772b6001a507812f84d752ca9e7648c6a1fa3e3203cafe51bdf4e7bc0953660db6d4b454
SSDEEP 6144:lmpTEguy4gpjb/6l6ZaXyrWpAKhhvOjHJx:lmWP6bSlI2yrihhm
TLSH
T14E447C4763E525F9E0B78238C9A54B46E771F8221330ABDF07A0865E1F237D1AD39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
klr.exe

File Explorer

klr.exe

.exe 265KB

klr.exe

IMPHASH ca192ca89afa647048bfa1f1c72dae0a
SHA256 4ee3511d715d4177f36658adab6e8c5114d3e129a5a7b96c99cc469effab8616
MD5 47eb3099e6aea06f22c6037f7f1df663
SHA1 f821ca00c914443374f39704d157fccdeaf87775
SHA512 b9cbb86f59aad2f875e5cf04d8bbb153320d193b48e43d2a89d3bcc5772b6001a507812f84d752ca9e7648c6a1fa3e3203cafe51bdf4e7bc0953660db6d4b454
SSDEEP 6144:lmpTEguy4gpjb/6l6ZaXyrWpAKhhvOjHJx:lmWP6bSlI2yrihhm
TLSH
T14E447C4763E525F9E0B78238C9A54B46E771F8221330ABDF07A0865E1F237D1AD39B61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\vboxuser\Desktop\BypassUAC-master\x64\Release\BypassUAC.pdb

kernel32

CreateFileW DeleteFileW SetFileAttributesW WriteFile GetTempPathW CloseHandle GetCurrentProcessId OpenProcess GetWindowsDirectoryW ReadProcessMemory GetModuleFileNameW GetModuleHandleW GetProcAddress lstrcpyW lstrcatW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetCommandLineW EncodePointer DecodePointer HeapAlloc RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess IsProcessorFeaturePresent HeapFree HeapSize Sleep IsDebuggerPresent IsValidCodePage GetACP GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection LoadLibraryExW OutputDebugStringW LoadLibraryW WideCharToMultiByte LCMapStringEx HeapReAlloc GetStringTypeW FlushFileBuffers WriteConsoleW

ole32

CoInitializeEx CoUninitialize CoGetObject

Sharing