handle64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
handle64.exe
Size 406KB
Sample260625-g6ggsshx81
SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
MD5 89f845fc4898f2d47a3a81f0b57c60f1
SHA1 b04a2347a0f94e87215424d816f9912c7bc248d5
SHA512 50bc14c4221ad984c3aa98327ee9127f7470a9a2b0a953544440a7b05f60f7f91209a96bd87d0d8f1e05551863dd43193f7f4231f382d6ad75d9f0a245939f04
SSDEEP 6144:MjRme/IYVCQ45De1/8GzfaD3f7oxakAuXeh3ohaYLCAyI5ub:MN9rVY5C1lq7oFpuoIGi
TLSH
T12A948E05F7E400E9E5B7A6348D758546DA727C594B30D6AF23A4866E1F33BC08E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

handle64.exe

.exe 406KB

handle64.exe

IMPHASH 16ebc883b0ec2b288357e5c53619efad
SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
MD5 89f845fc4898f2d47a3a81f0b57c60f1
SHA1 b04a2347a0f94e87215424d816f9912c7bc248d5
SHA512 50bc14c4221ad984c3aa98327ee9127f7470a9a2b0a953544440a7b05f60f7f91209a96bd87d0d8f1e05551863dd43193f7f4231f382d6ad75d9f0a245939f04
SSDEEP 6144:MjRme/IYVCQ45De1/8GzfaD3f7oxakAuXeh3ohaYLCAyI5ub:MN9rVY5C1lq7oFpuoIGi
TLSH
T12A948E05F7E400E9E5B7A6348D758546DA727C594B30D6AF23A4866E1F33BC08E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d8:58:88:1b:e4:bd:93:1a:6e:41:18:3f:13:b3:f1:a2:b1:fe:8a:05:45:01:af:a3:c6:16:d5:9f:81:a0:15:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 25, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

42512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\x64\Release\Handle64.pdb

kernel32

GetDriveTypeW GetFullPathNameW DuplicateHandle SetThreadErrorMode DeviceIoControl SetEvent WaitForSingleObject CreateEventW GetCurrentProcessId TerminateThread CreateProcessW OpenProcess GetSystemDirectoryW FormatMessageW FindClose GetConsoleScreenBufferInfo GetVersionExW LoadLibraryExW SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW DeleteFileW GetCurrentDirectoryW ExpandEnvironmentStringsW VerSetConditionMask FindResourceW LockResource SizeofResource GetCurrentProcess LoadResource SetLastError GetLastError CloseHandle CreateFileW LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetCommandLineW GetStdHandle GetModuleFileNameW VerifyVersionInfoW GetFileType FindFirstFileExW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetStdHandle ExitProcess GetModuleHandleExW GetConsoleCP CreateThread ExitThread FreeLibraryAndExitThread WriteFile GetCommandLineA HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile SetConsoleMode ReadConsoleInputW ReadConsoleW GetFileSizeEx SetFilePointerEx HeapReAlloc RtlUnwind

user32

SendMessageW DialogBoxIndirectParamW EndDialog LoadCursorW InflateRect GetSysColorBrush SetCursor SetWindowTextW GetDlgItem

gdi32

StartPage EndDoc StartDocW SetMapMode GetDeviceCaps EndPage

comdlg32

PrintDlgW

advapi32

LookupAccountSidW GetTokenInformation RegDeleteKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

handle64.exe

kernel32

user32

gdi32

comdlg32

advapi32

version

generic