patched[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
patched.exe
Size 16.2MB
Sample260620-m2pkhafw71
SHA256 cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03
MD5 748bd6d13b47240599f0bb4ed892b21c
SHA1 24773fbb2c15212bc1845bb9326c178d25c3fed5
SHA512 98e387f8e70f376c9c0bec151f7a6792f7762e058f0c5f3a4c942a34a3f1511bdfa20290d66e6caef14c0c665978e5582985d220920b2ab9121468f2a4aea74f
SSDEEP 196608:hrXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:hXVG3JgF3Z46FaayFsxT8TSfg4h
TLSH
T1790706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
patched.exe

File Explorer

patched.exe

.exe 16.2MB

patched.exe

IMPHASH 62f0383404f06951746d72084b01a844
SHA256 cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03
MD5 748bd6d13b47240599f0bb4ed892b21c
SHA1 24773fbb2c15212bc1845bb9326c178d25c3fed5
SHA512 98e387f8e70f376c9c0bec151f7a6792f7762e058f0c5f3a4c942a34a3f1511bdfa20290d66e6caef14c0c665978e5582985d220920b2ab9121468f2a4aea74f
SSDEEP 196608:hrXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:hXVG3JgF3Z46FaayFsxT8TSfg4h
TLSH
T1790706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10264812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ui.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtCreateFile NtWriteFile NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile

advapi32

RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyExW SystemFunction036 EventSetInformation EventWriteTransfer EventUnregister EventRegister

kernel32

OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW ReleaseSemaphore FreeLibrary GetModuleHandleA Sleep ReadDirectoryChangesW SetHandleInformation WaitForSingleObject GetProcAddress GetOverlappedResult ReleaseSRWLockExclusive AcquireSRWLockExclusive lstrlenW LoadLibraryA PostQueuedCompletionStatus ReadFile LoadLibraryW WakeAllConditionVariable CancelIoEx GetSystemFirmwareTable CreateIoCompletionPort GetModuleHandleW GetCurrentThreadId GetQueuedCompletionStatusEx GetFileAttributesW LCIDToLocaleName SetFileCompletionNotificationModes WaitForSingleObjectEx SleepConditionVariableSRW GetUserDefaultUILanguage GetConsoleMode GetSystemTimeAsFileTime LoadLibraryExA HeapAlloc RtlPcToFileHeader GetFileInformationByHandle RaiseException FlsAlloc CreateSemaphoreW FlsGetValue FormatMessageW CancelIo CreateFileW WriteFile FlsSetValue CreateFileA DeviceIoControl SetNamedPipeHandleState FlsFree CloseHandle GetLastError EncodePointer SetUnhandledExceptionFilter InitializeSListHead DeleteCriticalSection RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc GetCurrentProcess WideCharToMultiByte GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW RtlUnwindEx CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceFrequency MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx InitializeCriticalSectionEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW

user32

DestroyIcon SetForegroundWindow RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendInput SetWindowDisplayAffinity RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC GetSystemMenu EnableMenuItem SetPropW SetLayeredWindowAttributes ClipCursor IsProcessDPIAware GetDC GetClipCursor GetKeyState EnableWindow IsWindowEnabled ShowCursor GetMenu GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn IsWindowVisible GetMessageA TranslateMessage GetWindowTextLengthW GetWindowTextW DispatchMessageA GetWindowLongW SetWindowLongW ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW SetWindowTextW MonitorFromPoint GetKeyboardState EnumDisplayMonitors GetRawInputData AdjustWindowRect GetForegroundWindow DrawTextW GetWindowDC OffsetRect RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetMenuBarInfo DestroyMenu DrawIconEx CheckMenuItem GetActiveWindow UpdateWindow InvalidateRect SetCursorPos RemoveMenu LoadCursorW InvalidateRgn GetWindowPlacement CreatePopupMenu DestroyWindow TranslateAcceleratorW CreateMenu SetMenu DrawMenuBar RegisterClassExW CreateWindowExW SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW SetMenuItemInfoW FillRect AppendMenuW GetSystemMetrics InsertMenuW GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect ScreenToClient TrackPopupMenu DefWindowProcW PostThreadMessageW PeekMessageW DispatchMessageW GetMessageW IsIconic RedrawWindow SendMessageW PostQuitMessage PostMessageW CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW EnumChildWindows CreateIcon SystemParametersInfoA SetWindowPos GetAsyncKeyState

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ole32

CoUninitialize CoTaskMemFree CoCreateInstance RegisterDragDrop CoInitialize CoTaskMemAlloc OleInitialize CoCreateFreeThreadedMarshaler RevokeDragDrop CoInitializeEx

comctl32

SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect DefSubclassProc

shlwapi

SHCreateMemStream

gdi32

CreateCompatibleDC SelectObject CreateDIBSection CreateSolidBrush BitBlt GetDeviceCaps DeleteDC SetBkMode CombineRgn CreateRectRgn DeleteObject SetTextColor

shell32

DragFinish ILCreateFromPathW SHOpenFolderAndSelectItems ShellExecuteExW SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW ILFree DragQueryFileW SHAppBarMessage

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

ws2_32

freeaddrinfo getaddrinfo WSACleanup socket WSAGetLastError shutdown listen bind WSASocketW WSAStartup connect ioctlsocket setsockopt send WSASend recv getsockname getpeername accept getsockopt closesocket WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

pow roundf floor __setusermatherr round trunc

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit __p___argc _exit exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e _initterm abort _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe __p___argv _wassert

api-ms-win-crt-heap-l1-1-0

malloc free calloc _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale