pak[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pak.exe
Size 148KB
Sample260702-l697bses9k
SHA256 586fa1bdb3864d8b76d2117aaa7b14304203724d5e1c6a0cb5e1c7b074482374
MD5 790db5ab3df0a95f58eac62f88d90807
SHA1 35871525440274aa98b7b3b08a4bfbacd2a60432
SHA512 a8af3a2c8787d9875a60515cebf46470969ee3c1203869be104c69827a3a477027632297390debddab6812a9ee74385634e9c793a7741374f3e014d28219f488
SSDEEP 1536:vrzAAV1UVEFzsVy4maSXRaSXeWg9nbgqS8UvMFM7iN9R0/N/W8KMEyu2:vrzAAV1UCwKaR9nbgqSERRaZ2yu2
TLSH
T1F9E31ADBBB94DC97E911433805D68329533EF7908B874B132D20BA355E13BD0BED668A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pak.exe

File Explorer

pak.exe

.exe 148KB

pak.exe

IMPHASH 12c0268143cbbc860930d532b6d78713
SHA256 586fa1bdb3864d8b76d2117aaa7b14304203724d5e1c6a0cb5e1c7b074482374
MD5 790db5ab3df0a95f58eac62f88d90807
SHA1 35871525440274aa98b7b3b08a4bfbacd2a60432
SHA512 a8af3a2c8787d9875a60515cebf46470969ee3c1203869be104c69827a3a477027632297390debddab6812a9ee74385634e9c793a7741374f3e014d28219f488
SSDEEP 1536:vrzAAV1UVEFzsVy4maSXRaSXeWg9nbgqS8UvMFM7iN9R0/N/W8KMEyu2:vrzAAV1UCwKaR9nbgqSERRaZ2yu2
TLSH
T1F9E31ADBBB94DC97E911433805D68329533EF7908B874B132D20BA355E13BD0BED668A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateBitmap CreateCompatibleDC DeleteObject GetBitmapBits SelectObject SetBitmapBits

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy memset rand signal strlen strncmp vfprintf

user32

GetDC GetSystemMetrics MessageBoxW

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

pak.exe

gdi32

kernel32

msvcrt

user32

winmm

generic