TGZapret[.]exe | Triage™

General

Target
TGZapret.exe
Size 5.1MB
Sample260620-raphmsgx5s
SHA256 51caa2cec6aecbe77c279f5956ed364acc9f05ec580c98a465a89256fcb9ea9c
MD5 bdbca1c1f12a7bbb9478a22cc20ea6fb
SHA1 9f498d0c57865b28702fff8363a0a3c838326b68
SHA512 37c5e0e78cc394bc62f0d2188d4649687ba1e541e78eef6161f53e79195da32030e137bb33e2e82ddae3901fa7ff6266527f7712753330cf4d25054820dccbe0
SSDEEP 98304:dRjghzBj3IIK+nPGpz6kTAfk8XHeQRWRn1MkzghaxJTjiTLpjPvUQh:dWhdj3IIK+nPAz6QAfk8OQYbzwaxQpjJ
TLSH
T1E846332B96AD15E3E2EA6A34890ED8109F31B7B54E0F778F934454BA5F123C06D3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TGZapret.exe

File Explorer

TGZapret.exe

.exe 5.1MB

TGZapret.exe

IMPHASH d54f4ce7166adf987d04345af91ff939
SHA256 51caa2cec6aecbe77c279f5956ed364acc9f05ec580c98a465a89256fcb9ea9c
MD5 bdbca1c1f12a7bbb9478a22cc20ea6fb
SHA1 9f498d0c57865b28702fff8363a0a3c838326b68
SHA512 37c5e0e78cc394bc62f0d2188d4649687ba1e541e78eef6161f53e79195da32030e137bb33e2e82ddae3901fa7ff6266527f7712753330cf4d25054820dccbe0
SSDEEP 98304:dRjghzBj3IIK+nPGpz6kTAfk8XHeQRWRn1MkzghaxJTjiTLpjPvUQh:dWhdj3IIK+nPAz6QAfk8OQYbzwaxQpjJ
TLSH
T1E846332B96AD15E3E2EA6A34890ED8109F31B7B54E0F778F934454BA5F123C06D3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cabinet

ord43 ord45 ord40

user32

EnumDisplaySettingsA EnumDisplayDevicesA

kernel32

WriteConsoleW SetFilePointerEx CreateDirectoryW CreateFileW GetFileSize ReadFile SetFilePointer WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap CreateProcessW EnumSystemFirmwareTables GetSystemFirmwareTable GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TGZapret.exe

cabinet

user32

kernel32

generic