ext2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ext2.exe
Size 772KB
Sample260624-dclymshz2y
SHA256 5c09606cc06d3b3f2163bc0ad6fbf47de13828d57dd5e4b44ce60a6dc7e85060
MD5 dc988d82e5bcdb5bc99efc04461894d0
SHA1 c17fb992bff19ce943392206d6c0f8ad28d9ab7d
SHA512 c76ee3e89701f31e93547eae8773419e2fb58b3ed9c6da58f55646a0c180325a3fef09151414cba013a93c5dfa8a7e7d8780e3e9a1bf982e5ce57da423854112
SSDEEP 12288:nYxO+e0uMHx6ygPEdUgGmo7jbijhi2nj0TZOpudhyC6YLK2eoo:YY+HuMHx6ydUdbiti2nUZOpudh+YW2
TLSH
T15FF49E44FBF440B4D17BA13899A6EF2FEB36784807205ADF63D405593FA66E04B76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ext2.exe

File Explorer

ext2.exe

.exe 772KB

ext2.exe

IMPHASH 55aa6d07de289da27ee219984e508b72
SHA256 5c09606cc06d3b3f2163bc0ad6fbf47de13828d57dd5e4b44ce60a6dc7e85060
MD5 dc988d82e5bcdb5bc99efc04461894d0
SHA1 c17fb992bff19ce943392206d6c0f8ad28d9ab7d
SHA512 c76ee3e89701f31e93547eae8773419e2fb58b3ed9c6da58f55646a0c180325a3fef09151414cba013a93c5dfa8a7e7d8780e3e9a1bf982e5ce57da423854112
SSDEEP 12288:nYxO+e0uMHx6ygPEdUgGmo7jbijhi2nj0TZOpudhyC6YLK2eoo:YY+HuMHx6ydUdbiti2nUZOpudh+YW2
TLSH
T15FF49E44FBF440B4D17BA13899A6EF2FEB36784807205ADF63D405593FA66E04B76322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Infected

Minor OS version

Major OS version

Entry point

464352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

SetConsoleTitleA GetStdHandle DeviceIoControl WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep Process32Next CloseHandle Beep lstrcmpiA CreateProcessA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock Process32First GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleHandleW GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcessId GetSystemTimeAsFileTime SetConsoleTextAttribute WakeAllConditionVariable GlobalUnlock SetUnhandledExceptionFilter InitializeSListHead WideCharToMultiByte

user32

UpdateWindow FindWindowA GetKeyState LoadCursorA ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect SetMenu SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DispatchMessageA SetWindowPos GetCursorPos GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA MessageBoxA PeekMessageA mouse_event TranslateMessage SetLayeredWindowAttributes

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr strstr memcpy memmove memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf ftell __p__commode _wfopen fwrite fflush fread _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf_s __acrt_iob_func fclose fseek __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode realloc malloc free

api-ms-win-crt-string-l1-1-0

strcmp toupper tolower strlen strncmp wcslen strncpy

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _register_onexit_function _get_initial_narrow_environment _initterm _initterm_e exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment _crt_atexit _configure_narrow_argv terminate

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

atan2 acosf atanf logf ceilf asin fmodf sinf powf sqrt sqrtf tanf ldexp __setusermatherr cosf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale