safew_tseup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
safew_tseup.exe
Size 139.0MB
Sample260629-dnmdjsbz2z
SHA256 8b8d0fe656209302a8d20ebaf7807f73846119d6916e3a02795b686c8890596e
MD5 e62fbeef55ee3eef5cc424b2edf0fe8c
SHA1 0745a3b995a076be48733ff63dad2fc75600b1a0
SHA512 4120c8f574bca3f9ae95416def4572114f1c4ee31a0520d67821c694e05d80a0dea125046d4fc257de2dcf6eba5ca4b323951e09ef6e51a0ea4e21f72fc10924
SSDEEP 3145728:jF3LDCpQYpO9i+y5X3T90DCt4ixigSNibTn1:j1nA+y5niDC3Vb71
TLSH
T11668E012B6D48075E5BB3230192D7368967EBD204F7081CB3298BBAD6E716C25F32767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
safew_tseup.exe

File Explorer

safew_tseup.exe

.exe 139.0MB

safew_tseup.exe

IMPHASH 192bf4d39772e2fb47bdc7367ddc86eb
SHA256 8b8d0fe656209302a8d20ebaf7807f73846119d6916e3a02795b686c8890596e
MD5 e62fbeef55ee3eef5cc424b2edf0fe8c
SHA1 0745a3b995a076be48733ff63dad2fc75600b1a0
SHA512 4120c8f574bca3f9ae95416def4572114f1c4ee31a0520d67821c694e05d80a0dea125046d4fc257de2dcf6eba5ca4b323951e09ef6e51a0ea4e21f72fc10924
SSDEEP 3145728:jF3LDCpQYpO9i+y5X3T90DCt4ixigSNibTn1:j1nA+y5niDC3Vb71
TLSH
T11668E012B6D48075E5BB3230192D7368967EBD204F7081CB3298BBAD6E716C25F32767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ord17

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileStringW GetProcAddress GetProcessHeap GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LoadResource LocalAlloc LocalFree LockResource MoveFileExW MoveFileW MulDiv MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadFile RemoveDirectoryW RtlUnwind SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

Name

.text

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

2KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

safew_tseup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic