test[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
test.rar
Size 1.4MB
Sample260627-d2c22ahs7q
SHA256 73544ea707f9121ca547268919c9c505b3d7e7374505f9f6afc04bad438a6628
MD5 eeea4122bcce1d6ff8f67065304d0fa0
SHA1 3a2203af600e44c5829800b11cee8a20e6fda48f
SHA512 56b3e5e44bfc55573da6bed25db905e279d423283410e0012e0789d7a32661bd34720d9944361ed75e2bcf90c4abcfdaac5fc4b5eefe4f224e4bd806f250b073
SSDEEP 24576:FC66Qhb+1j5YjjB/w/yWWd1P71BOiB/u838mEV+Rk2yz/II7y5xOAXRGYnzN7Yj3:8ubwYR/w/dWFNhyV6k2c/V7eR1zVYJB
TLSH
T1B4653386F2B67B816FA601EC50CCD805E4DF2DE972F24E2356DACC763E054B0D75A286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/OpenIV.exe

File Explorer

test.rar

.rar 1.4MB
OpenIV.exe

.exe 2.1MB
bypassAC.png

.png 175KB

test.rar

SHA256 73544ea707f9121ca547268919c9c505b3d7e7374505f9f6afc04bad438a6628
MD5 eeea4122bcce1d6ff8f67065304d0fa0
SHA1 3a2203af600e44c5829800b11cee8a20e6fda48f
SHA512 56b3e5e44bfc55573da6bed25db905e279d423283410e0012e0789d7a32661bd34720d9944361ed75e2bcf90c4abcfdaac5fc4b5eefe4f224e4bd806f250b073
SSDEEP 24576:FC66Qhb+1j5YjjB/w/yWWd1P71BOiB/u838mEV+Rk2yz/II7y5xOAXRGYnzN7Yj3:8ubwYR/w/dWFNhyV6k2c/V7eR1zVYJB
TLSH
T1B4653386F2B67B816FA601EC50CCD805E4DF2DE972F24E2356DACC763E054B0D75A286
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

OpenIV.exe

IMPHASH c3db604bf4d987515aa75810fc433894
SHA256 58ef8d2c522640f8aede76b3b913abbc7184abc9f7ea8519dba38bf24297882a
MD5 7966f49ed196a24568e0167ce0d43995
SHA1 6a033f00efcf853f103d0e6a8a085fbe16773f2f
SHA512 9a3ff5032c5b6d9646a0935a8e6a93e18268a01ac708a5c09a7589298b8c58491ee8286f75b62be81e91f3837faed91be1bc7f3b58b99d7170dea370bba52fe2
SSDEEP 49152:TOfG7uhDoNpkxugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Gx6iUg:TiuXxo3W
TLSH
T154A5C0BA72587358C02AC9389423BE07F175381A076586DF73DABAD02F9B5D09E35B43
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

502712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

OpenSCManagerW ConvertSidToStringSidA RegQueryValueExA SetTokenInformation SetThreadToken RegOpenKeyExA CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RevertToSelf RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetEntriesInAclW AllocateAndInitializeSid PrivilegeCheck CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW GetTokenInformation

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

winhttp

WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpConnect

kernel32

InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter FormatMessageA GetFileAttributesExW FindNextFileW FindFirstFileExW FindClose SetUnhandledExceptionFilter AreFileApisANSI WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW GetLocaleInfoEx DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx CreateFileA GetCurrentProcessId CreateDirectoryA GetCurrentThreadId LoadLibraryA CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread Module32FirstW Module32NextW ReadFile FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle GetEnvironmentVariableA GetCurrentThread QueryPerformanceFrequency DeleteFileA FreeConsole FillConsoleOutputAttribute GetThreadContext ExitProcess SetConsoleCursorPosition QueryPerformanceCounter AllocConsole IsDebuggerPresent CheckRemoteDebuggerPresent GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStartupInfoW GetCommandLineW SleepConditionVariableSRW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable FindFirstFileW SetFileInformationByHandle

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW SetWindowLongW SetForegroundWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard GetWindowLongW TranslateMessage GetWindowRect CloseClipboard EmptyClipboard GetClipboardData SetClipboardData FindWindowW GetAsyncKeyState DispatchMessageW PeekMessageW

shell32

SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Mtx_lock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

shlwapi

PathStripPathW

wininet

InternetCloseHandle InternetReadFile InternetOpenUrlA InternetOpenA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __current_exception_context __current_exception memset memcpy memchr memcmp wcsstr __C_specific_handler strstr strchr __std_exception_copy _CxxThrowException __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fputc __stdio_common_vswprintf_s __stdio_common_vsscanf fread _wfopen __stdio_common_vsprintf __stdio_common_vfprintf fseek ftell freopen_s _set_fmode __stdio_common_vsprintf_s __acrt_iob_func fsetpos ungetc __p__commode fflush setvbuf fgetpos _fseeki64 fwrite fclose fgetc

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

tolower _wcsicmp towlower strcpy_s wcscpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _wsystem _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line terminate _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _beginthreadex exit _crt_atexit _register_onexit_function _initialize_onexit_table abort

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

cosf ceilf sqrtf acosf fmodf logf pow powf sinf sqrt __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func