tcpview[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tcpview.exe
Size 922KB
Sample260626-3wt6ssft7y
SHA256 9775b4bbe23b8eb93727efe0a6d0b160ae5132a10b223f43200499cf0051a18f
MD5 7ce89829f9fb955dc377529c461852fd
SHA1 8b14f5345bfcfac08c31c284c1a0eee2cd53bcfb
SHA512 7b9cd587ba53f632a1eff914a6a4bfc345b2232ed6dc02dfefa9bc9aebe06ff7836c1698077f41483a34b0610e92549b1a4baf8b9e9b29c28469f53ec6722e0c
SSDEEP 24576:hzAHF/xZkg6Yf5HnfpFFFLChKMdDBbPex:0Zkg6Yf5/pFFFOhKMdDB0
TLSH
T1CF157EC271604670CCB7AB3020B6967A0DFA6D398BF145DB5E88795E7B381C62E31727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

tcpview.exe

.exe 922KB

tcpview.exe

IMPHASH b49357ca9f479242c82cda47ccb11321
SHA256 9775b4bbe23b8eb93727efe0a6d0b160ae5132a10b223f43200499cf0051a18f
MD5 7ce89829f9fb955dc377529c461852fd
SHA1 8b14f5345bfcfac08c31c284c1a0eee2cd53bcfb
SHA512 7b9cd587ba53f632a1eff914a6a4bfc345b2232ed6dc02dfefa9bc9aebe06ff7836c1698077f41483a34b0610e92549b1a4baf8b9e9b29c28469f53ec6722e0c
SSDEEP 24576:hzAHF/xZkg6Yf5HnfpFFFLChKMdDBbPex:0Zkg6Yf5/pFFFOhKMdDB0
TLSH
T1CF157EC271604670CCB7AB3020B6967A0DFA6D398BF145DB5E88795E7B381C62E31727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

122222222

Digest

4d:80:35:cd:5f:63:f0:7b:4b:3b:13:54:0a:ec:8b:55:5d:27:31:83:5c:1b:44:fe:72:dc:ed:36:95:7a:ce:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 6, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cb

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 12, 2022 - May 11, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ca:4f:c2:b3:ed:03:0d:18:6c:00:01:00:00:01:ca

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 4, 2022 - Feb 2, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

214978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\exe\Win32\Release\TcpView.pdb

kernel32

CreateThread GetSystemTimeAsFileTime FileTimeToLocalFileTime GetTickCount64 FileTimeToSystemTime SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleInputW SetConsoleMode GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW GetConsoleCP lstrcmpiW DecodePointer TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetCPInfo LCMapStringEx AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetStringTypeW LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCurrentProcessId Process32NextW Process32FirstW CreateToolhelp32Snapshot QueryFullProcessImageNameW OpenProcess ExitProcess VerifyVersionInfoW lstrcmpW VirtualQuery SetPriorityClass SetThreadPriority GetCurrentThread CreateDirectoryW VerSetConditionMask GetNumberFormatEx GetLocaleInfoW GetTimeFormatW GetDateFormatW FormatMessageW GetModuleHandleExW GetModuleFileNameA DebugBreak WideCharToMultiByte MultiByteToWideChar TrySubmitThreadpoolCallback VirtualAlloc lstrlenW MulDiv LoadLibraryW FreeLibrary GetThreadId CloseHandle GetTempPathW WriteFile GetTempFileNameW DeleteFileW CreateFileW GetModuleFileNameW GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection TerminateProcess EnterCriticalSection GetLastError WritePrivateProfileStructW GetPrivateProfileStructW WritePrivateProfileStringW GetPrivateProfileStringW WriteConsoleW GetPrivateProfileIntW GetFileAttributesW GetCurrentProcess FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy RaiseException GlobalLock GlobalUnlock GlobalAlloc LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetFileType GetCommandLineW GetStdHandle LoadLibraryExW GetVersionExW TlsFree SetLastError

user32

RemoveMenu AppendMenuW GetSubMenu CreatePopupMenu LoadMenuW LoadAcceleratorsW GetKeyState CharNextW CharLowerW PostQuitMessage GetMessagePos PeekMessageW DispatchMessageW TranslateMessage GetMessageW DrawFrameControl DrawEdge GetMenuInfo LoadStringA LoadIconW SetRectEmpty MonitorFromPoint MessageBoxW LockWindowUpdate GetMenuItemInfoW TrackPopupMenuEx ModifyMenuW GetMenuItemCount GetMenuStringW SetMenu GetMenu TranslateAcceleratorW GetActiveWindow GetDlgCtrlID DialogBoxParamW SetMenuInfo SetMenuDefaultItem MessageBeep GetCursorPos RegisterWindowMessageW WindowFromPoint GetWindowThreadProcessId SendMessageW DialogBoxIndirectParamW EndDialog GetDlgItem SetWindowTextW SetCursor CheckMenuRadioItem EnableWindow SetScrollInfo CreateDialogParamW SetWindowPlacement GetWindowPlacement DestroyWindow IsMenu IsWindow LoadStringW GetWindow MapWindowPoints GetWindowRect SetDlgItemTextW GetSysColorBrush InflateRect LoadCursorW OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DestroyMenu SetMenuItemInfoW GetSysColor LoadImageW GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW GetScrollInfo GetMenuItemID DestroyIcon DrawIconEx DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW SetFocus GetFocus SetTimer KillTimer DrawTextW BeginPaint EndPaint InvalidateRect GetWindowTextW GetWindowTextLengthW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongW PtInRect OffsetRect CopyRect FrameRect FillRect DrawFocusRect ScreenToClient ShowScrollBar SetScrollPos RedrawWindow ReleaseDC GetWindowDC GetDC UpdateWindow GetSystemMetrics IsWindowEnabled IsZoomed IsWindowVisible SetWindowPos MoveWindow ShowWindow IsChild PostMessageW GetParent SetWindowLongW GetWindowLongW GetClientRect

gdi32

ExcludeClipRect CreatePatternBrush PatBlt SetBrushOrgEx CreateBitmap CreateDIBSection GetCurrentObject Polyline TextOutW MoveToEx SetTextAlign Rectangle LineTo GetTextExtentPoint32W GetStockObject CreatePen CreateSolidBrush GetObjectW SetTextColor GetDeviceCaps SetMapMode StartDocW EndDoc StartPage EndPage BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject SetBkColor ExtTextOutW SetBkMode CreateFontIndirectW

comdlg32

ChooseFontW GetSaveFileNameW GetOpenFileNameW PrintDlgW

advapi32

ControlTraceW RegCreateKeyW RegOpenKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegGetValueW OpenProcessToken GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW ProcessTrace OpenTraceW RegCloseKey StartTraceW RegQueryInfoKeyW RegEnumKeyExW

shell32

SHGetFolderPathW ShellExecuteW ExtractIconExW ExtractIconW

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoInitialize CoTaskMemFree CoUninitialize

oleaut32

VarUI4FromStr

comctl32

ImageList_Destroy ImageList_DrawEx ImageList_GetIconSize ImageList_Create ImageList_GetImageCount ImageList_ReplaceIcon ImageList_DrawIndirect CreateStatusWindowW InitCommonControlsEx ImageList_Draw

uxtheme

SetWindowTheme IsThemeActive IsAppThemed

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

dwmapi

DwmSetWindowAttribute DwmDefWindowProc

iphlpapi

GetOwnerModuleFromTcpEntry GetExtendedUdpTable GetOwnerModuleFromUdpEntry GetOwnerModuleFromTcp6Entry GetOwnerModuleFromUdp6Entry SetTcpEntry GetExtendedTcpTable

ws2_32

getservbyport gethostname socket send WSAGetLastError htons connect closesocket ntohs getaddrinfo freeaddrinfo GetNameInfoW WSAStartup recv

tdh

TdhGetPropertySize TdhGetEventInformation

Sharing

General

Malware Config

Signatures

File Explorer

tcpview.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

version

dwmapi

iphlpapi

ws2_32

tdh

generic