get_hwid[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
get_hwid.exe
Size 38KB
Sample260628-tsxcbaas2y
SHA256 87953b537451555e9bbf1911ee7aeccae23a23eb88c69582bef6a121f041eaa1
MD5 7868f3837ad98c4359949071d3a43b8c
SHA1 7e81f96b189ef01db0da103f39ab56c6d899879a
SHA512 73205360738705b34ce7e95bcfa69d99b831ff0ca3c99dbb384506d3954a3632e8593d6db65c940f92416e58ec98c210e7577355d419f9dcc91e9da08c05cf41
SSDEEP 384:eipC1UA/UVDLql7wx0zKO59BrzZJfuHEcs9wMbT6+lIXURuZoijtBKYkOlCtNRuO:ATUO7wx09533ukcEnbTw5kHPz3aU
TLSH
T1BD03D71ADE1790EBD35D8DB4D6030901DE72BCC68BE1B2CBA7915CD50E65BE4AB3B201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
get_hwid.exe

File Explorer

get_hwid.exe

.exe 38KB

get_hwid.exe

IMPHASH d15b6cbfbba1288e005aad55e3f23c23
SHA256 87953b537451555e9bbf1911ee7aeccae23a23eb88c69582bef6a121f041eaa1
MD5 7868f3837ad98c4359949071d3a43b8c
SHA1 7e81f96b189ef01db0da103f39ab56c6d899879a
SHA512 73205360738705b34ce7e95bcfa69d99b831ff0ca3c99dbb384506d3954a3632e8593d6db65c940f92416e58ec98c210e7577355d419f9dcc91e9da08c05cf41
SSDEEP 384:eipC1UA/UVDLql7wx0zKO59BrzZJfuHEcs9wMbT6+lIXURuZoijtBKYkOlCtNRuO:ATUO7wx09533ukcEnbTw5kHPz3aU
TLSH
T1BD03D71ADE1790EBD35D8DB4D6030901DE72BCC68BE1B2CBA7915CD50E65BE4AB3B201
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableA SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

advapi32

CryptDestroyHash CryptAcquireContextA CryptReleaseContext CryptHashData CryptCreateHash CryptGetHashParam

msvcp140

?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ

vcruntime140

memmove memset __C_specific_handler memcpy __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate __current_exception memcmp _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm_e __p___argc _configure_narrow_argv _cexit _exit exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _set_app_type _initterm _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _c_exit __p___argv system

api-ms-win-crt-stdio-l1-1-0

_pclose fgets _set_fmode __p__commode _popen

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale