TrapExternal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TrapExternal.exe
Size 557KB
Sample260701-pllvsaf16s
SHA256 05bb3dcaf573e64b7282068e87304ef8a2ac8438e13ccf4d0e9428ea9a6fb915
MD5 1a9156c39733b0c8932a6b464b9ee07f
SHA1 eee17e429c7dc8e4f5728c841aefceb63a45b964
SHA512 a1ada1c7df21ce5f403c16b46dac69b7c15a7b4c28102b1c0f4147d2a993316d95f67bc6fef95c05c63cb6cce6eae1aceb1b1685536080f8d8cb9dd55624769d
SSDEEP 12288:ilIFChyr24HmiagHNVdgJdk4iD33WUn97Tb+9:RFCwr1HA81/4iSUndTbc
TLSH
T149C4AE81F1F952F8E03B9134969AB61BFA393808171059CB63D409982FB77E45BFB712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TrapExternal.exe

File Explorer

TrapExternal.exe

.exe 557KB

TrapExternal.exe

IMPHASH 95d9c3824d266f7256686ca900715bd3
SHA256 05bb3dcaf573e64b7282068e87304ef8a2ac8438e13ccf4d0e9428ea9a6fb915
MD5 1a9156c39733b0c8932a6b464b9ee07f
SHA1 eee17e429c7dc8e4f5728c841aefceb63a45b964
SHA512 a1ada1c7df21ce5f403c16b46dac69b7c15a7b4c28102b1c0f4147d2a993316d95f67bc6fef95c05c63cb6cce6eae1aceb1b1685536080f8d8cb9dd55624769d
SSDEEP 12288:ilIFChyr24HmiagHNVdgJdk4iD33WUn97Tb+9:RFCwr1HA81/4iSUndTbc
TLSH
T149C4AE81F1F952F8E03B9134969AB61BFA393808171059CB63D409982FB77E45BFB712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

438576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

OpenProcess ReadProcessMemory WriteProcessMemory Process32FirstW Process32NextW Module32FirstW Module32NextW Sleep GetTickCount GetModuleHandleA GetTickCount64 OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GetModuleHandleW MultiByteToWideChar CreateToolhelp32Snapshot QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetCurrentProcessId GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CloseHandle WakeAllConditionVariable SetUnhandledExceptionFilter WideCharToMultiByte GetSystemTimeAsFileTime GlobalFree InitializeSListHead

user32

MessageBoxA SetCursor SetCursorPos GetClientRect LoadCursorA ClientToScreen GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard FindWindowW SetWindowLongPtrW GetWindowLongPtrW GetWindowRect SetForegroundWindow UpdateWindow SetFocus SetWindowPos SetLayeredWindowAttributes ShowWindow IsWindow CreateWindowExW ScreenToClient RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA GetAsyncKeyState TranslateMessage keybd_event mouse_event GetCursorPos SendInput GetSystemMetrics

shell32

ShellExecuteW

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?width@ios_base@std@@QEBA_JXZ ?_Random_device@std@@YAIXZ

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

vcruntime140

memcmp memmove strchr __C_specific_handler __current_exception memchr memcpy _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __current_exception_context memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode fread fseek fflush fclose __p__commode ftell _wfopen __acrt_iob_func fwrite __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf

api-ms-win-crt-math-l1-1-0

log logf sinf __setusermatherr powf ceilf cosf fmodf roundf sqrtf acosf pow atan2f

api-ms-win-crt-string-l1-1-0

strcmp wcslen strncmp strncpy strlen

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

exit _initterm terminate _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _c_exit _get_initial_narrow_environment __p___argv _initterm_e _exit __p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale