meccha-camouflage[.]exe

General

Target
meccha-camouflage.exe
Size 1.1MB
Sample260625-thd3zsc16w
SHA256 0f273ec76d7de1448012ee0039318a6e4307e33ce40999a2a3976e9744970d88
MD5 9147a78b2aadf8f975fd1ad9732d979f
SHA1 eb540ea2b65bc582b55330043822102db737f40d
SHA512 1a195df5a855a88533329aa6a418427d9165c8069ca6f296956e52b2889678b114fa510beff956941a76907300b59ec8ef9ea9251a92e5a69f98305a14295676
SSDEEP 24576:VAoeD899wZPNbkFeJ88T9bwaeCoK7j/jlFewE3JwziLLnHUOX9D0:VAf8sJS8T9zFEZw2Ld94
TLSH
T116455C3AA78811BDE0B6C279CE475943E67634090371D9FF03D155A61E5BAE0EE3BB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meccha-camouflage.exe

File Explorer

meccha-camouflage.exe

.exe 1.1MB

meccha-camouflage.exe

IMPHASH c42c665deb392ae879c35429419bde91
SHA256 0f273ec76d7de1448012ee0039318a6e4307e33ce40999a2a3976e9744970d88
MD5 9147a78b2aadf8f975fd1ad9732d979f
SHA1 eb540ea2b65bc582b55330043822102db737f40d
SHA512 1a195df5a855a88533329aa6a418427d9165c8069ca6f296956e52b2889678b114fa510beff956941a76907300b59ec8ef9ea9251a92e5a69f98305a14295676
SSDEEP 24576:VAoeD899wZPNbkFeJ88T9bwaeCoK7j/jlFewE3JwziLLnHUOX9D0:VAf8sJS8T9zFEZw2Ld94
TLSH
T116455C3AA78811BDE0B6C279CE475943E67634090371D9FF03D155A61E5BAE0EE3BB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

177516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket inet_pton WSAGetLastError WSACleanup WSAStartup socket setsockopt send recv ntohs htons getsockname connect bind

user32

GetAsyncKeyState UnregisterHotKey RegisterHotKey PeekMessageW DispatchMessageW TranslateMessage

kernel32

EnterCriticalSection SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetEnvironmentVariableW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId CreateRemoteThread GetExitCodeThread OpenProcess GetSystemTime GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW LocalFree FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI MoveFileExW GetFileInformationByHandleEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent RtlUnwind LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess InitializeSListHead GetFileType RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

Name

.text

Size

330KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

692KB

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

meccha-camouflage.exe

ws2_32

user32

kernel32

generic