O2HdKrkkcy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
O2HdKrkkcy.exe
Size 22.7MB
Sample260702-rh2syacz2k
SHA256 5a2f65ad4b61d3b6cee20e8b89d100d1a051b25a655692dec0f777ff9e598c9d
MD5 d1a2e69d10ca0c7695e8b0e7871479c6
SHA1 140408dc1ec7acd3eeb0c22e0bf8adbe72cdff93
SHA512 460efc285aa915778cdf62699440823f975ebe822078674e2fd339fe2e38788731dcf0eb3575dca6529ad1708aaf636bef1a8a8078fdabace4be1fd3a4182d56
SSDEEP 393216:1/NaoPL5Y8V0HruFKuXbmKHL+iyr7xaE8SBVIvr8UdpoqEpLOoAdSpv:1/NaouruguXbmgGr7jNevr8UxEvAdS
TLSH
T1943723E158D816F4F3E74B04C1C7224FA3923677DF96EA0D16C49C031A62E979A46F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
O2HdKrkkcy.exe

File Explorer

O2HdKrkkcy.exe

.exe 22.7MB

O2HdKrkkcy.exe

IMPHASH 005edf902bc5cb85fcf7781274e7b4ec
SHA256 5a2f65ad4b61d3b6cee20e8b89d100d1a051b25a655692dec0f777ff9e598c9d
MD5 d1a2e69d10ca0c7695e8b0e7871479c6
SHA1 140408dc1ec7acd3eeb0c22e0bf8adbe72cdff93
SHA512 460efc285aa915778cdf62699440823f975ebe822078674e2fd339fe2e38788731dcf0eb3575dca6529ad1708aaf636bef1a8a8078fdabace4be1fd3a4182d56
SSDEEP 393216:1/NaoPL5Y8V0HruFKuXbmKHL+iyr7xaE8SBVIvr8UdpoqEpLOoAdSpv:1/NaouruguXbmgGr7jNevr8UxEvAdS
TLSH
T1943723E158D816F4F3E74B04C1C7224FA3923677DF96EA0D16C49C031A62E979A46F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17643729

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumWindows

kernel32

AcquireSRWLockExclusive GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

advapi32

AddAccessAllowedAce

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

shell32

ShellExecuteA

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

ntdll

RtlCaptureContext

ws2_32

WSACleanup

userenv

UnloadUserProfile

crypt32

CertAddCertificateContextToStore

bcrypt

BCryptGenRandom

vcruntime140

_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

Virtual Size

140B

Characteristics

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.]dW

Size

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.?I$

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Cla

Size

22.7MB

Virtual Size

22.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

422B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

O2HdKrkkcy.exe

user32

kernel32

advapi32

msvcp140

shell32

shlwapi

psapi

ntdll

ws2_32

userenv

crypt32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic