hgvcuj[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hgvcuj.exe
Size 97KB
Sample260623-wevbxaex2m
SHA256 08ca0ed00af089d8fe64c3532a09699d6f3d1b7088f65cc3b1e6384ca73cca8a
MD5 b6c6a5489bf8b63befe4e0585243cba6
SHA1 7ceca8a58658eae72179d6714d96d030077fe428
SHA512 66bce911899e7c68f979fea6f1ef40b71e6928e63ba9c9e79c47e081bec451f7c9160a4df358332441d204dcca6e6165f19d68f46e69f8a4fe861f8269d61c34
SSDEEP 1536:86vGQ41+nJWVx9D1y29G3z4b+etBnw+wJSfI2ArfCWVcnWJgrZopa:86vG4qx9D104bDt1whJKPAjCVo
TLSH
T1F6A34D2AAA5A40EBD269C97CCE534906D7B3BC814761B3CF67910DD60E367D49F3A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hgvcuj.exe

File Explorer

hgvcuj.exe

.exe 97KB

hgvcuj.exe

IMPHASH 38779c0e256066dc39dab5dba0dbe089
SHA256 08ca0ed00af089d8fe64c3532a09699d6f3d1b7088f65cc3b1e6384ca73cca8a
MD5 b6c6a5489bf8b63befe4e0585243cba6
SHA1 7ceca8a58658eae72179d6714d96d030077fe428
SHA512 66bce911899e7c68f979fea6f1ef40b71e6928e63ba9c9e79c47e081bec451f7c9160a4df358332441d204dcca6e6165f19d68f46e69f8a4fe861f8269d61c34
SSDEEP 1536:86vGQ41+nJWVx9D1y29G3z4b+etBnw+wJSfI2ArfCWVcnWJgrZopa:86vG4qx9D104bDt1whJKPAjCVo
TLSH
T1F6A34D2AAA5A40EBD269C97CCE534906D7B3BC814761B3CF67910DD60E367D49F3A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

DeleteObject GetDIBits SelectObject SetDIBitsToDevice CreateSolidBrush GetStockObject PlgBlt Polyline CreateCompatibleDC CreateCompatibleBitmap CreatePen BitBlt

user32

DrawIconEx CallNextHookEx GetDC MessageBoxW GetSystemMetrics FillRect ScreenToClient GetCursorPos WindowFromDC ReleaseDC MoveWindow UnhookWindowsHookEx LoadImageW SetWindowsHookExW

kernel32

GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter QueryPerformanceCounter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW CreateFileA WriteFile GetTempPathA CloseHandle Sleep ExitProcess GetTickCount GetProcAddress LoadLibraryA lstrcpyA lstrcatA GetCurrentThreadId WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW UnhandledExceptionFilter InitializeSListHead

shell32

ShellExecuteA

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey

msvcp140

_Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z

winmm

waveOutReset waveOutOpen waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutClose

dwmapi

DwmFlush

vcruntime140

__current_exception __current_exception_context memmove memset memcpy _CxxThrowException __std_exception_destroy __std_exception_copy __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _beginthreadex terminate _invoke_watson _register_onexit_function

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-math-l1-1-0

cosf sinf fmodf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

fread fputc fgetpos _fseeki64 __p__commode _set_fmode __stdio_common_vfprintf ungetc fgetc fflush fclose _get_stream_buffer_pointers __acrt_iob_func fwrite setvbuf fsetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale