this one [.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
this one .exe
Size 500KB
Sample260702-wf8wpabs4y
SHA256 ead63d4bf9e2c8ee0c22a3db6f01e9dbd9368a56114baaab4bdcfc5894180ac1
MD5 7db6622ad92fc5a86c5f5aa10415526a
SHA1 387f3ab65b3c5ff24331a4df55d400ce6d85edfe
SHA512 8365f5b5f9643e72b1999992ac9562a9a326b3a4d9bda97f642e96d622dca9fcd83e378298ecaa9ee2ff3cfb3db9830bfc987d999df4e34f34957764e2a0a0ac
SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/fOdbEZUd4rQk:vAHdCmbeNjDYkzfQwY
TLSH
T1CDB47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
this one .exe

File Explorer

this one .exe

.exe 500KB

this one .exe

IMPHASH bcac76bb6976db70842f08f6e2e54ce6
SHA256 ead63d4bf9e2c8ee0c22a3db6f01e9dbd9368a56114baaab4bdcfc5894180ac1
MD5 7db6622ad92fc5a86c5f5aa10415526a
SHA1 387f3ab65b3c5ff24331a4df55d400ce6d85edfe
SHA512 8365f5b5f9643e72b1999992ac9562a9a326b3a4d9bda97f642e96d622dca9fcd83e378298ecaa9ee2ff3cfb3db9830bfc987d999df4e34f34957764e2a0a0ac
SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/fOdbEZUd4rQk:vAHdCmbeNjDYkzfQwY
TLSH
T1CDB47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

243940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadResource SetUnhandledExceptionFilter LoadLibraryExW InitializeCriticalSectionAndSpinCount SizeofResource LeaveCriticalSection lstrlenW SetLastError EnterCriticalSection lstrcmpiW DeleteCriticalSection GetCurrentThreadId GetVersion CreateFileW SetFilePointer SetEndOfFile ReadFile FindFirstFileW FindClose FindNextFileW WriteFile CopyFileW ReadProcessMemory GetFileSizeEx VirtualProtectEx WideCharToMultiByte GetVersionExW GetSystemInfo GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType SetHandleCount HeapReAlloc FindResourceW GetStdHandle HeapCreate HeapSetInformation GetStringTypeW ExitProcess HeapSize Sleep FlsAlloc FlsFree FlsSetValue FlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter TerminateProcess RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW GetCommandLineW DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree GetProcessHeap HeapAlloc HeapFree InterlockedPushEntrySList GetLastError lstrlenA MultiByteToWideChar CreateFileMappingW MapViewOfFile GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers WriteConsoleW ResumeThread WriteProcessMemory CloseHandle GetExitCodeThread VirtualAllocEx SetThreadPriority LoadLibraryW VirtualFreeEx CreateRemoteThread WaitForSingleObject FreeLibrary GlobalFree RaiseException FlushInstructionCache GlobalUnlock MulDiv GlobalAlloc GlobalLock GetCurrentProcess QueryDosDeviceW GetPrivateProfileIntW WritePrivateProfileStringW GetModuleFileNameW GetPrivateProfileStringW GetModuleHandleA LoadLibraryA GetProcAddress VirtualQueryEx GetModuleHandleW LCMapStringW UnmapViewOfFile

user32

LoadIconW DragDetect IntersectRect IsDialogMessageW GetMenu AppendMenuW InflateRect GetKeyState GetSysColor GetActiveWindow AdjustWindowRectEx ReleaseCapture SetCapture PostQuitMessage ScreenToClient LoadAcceleratorsW ReleaseDC DialogBoxParamW EnableWindow GetMessagePos DestroyAcceleratorTable GetMessageW CharNextW TranslateAcceleratorW GetWindowTextLengthW SetDlgItemTextW EnableMenuItem TranslateMessage PeekMessageW CreateDialogParamW DispatchMessageW UpdateWindow LoadImageW GetDC GetDesktopWindow DestroyIcon SetFocus ClientToScreen CloseClipboard MonitorFromPoint TrackPopupMenu GetSubMenu IsClipboardFormatAvailable MessageBeep GetWindowLongPtrW InvalidateRect LoadMenuW GetClipboardData GetWindowTextW EmptyClipboard SetWindowLongW RedrawWindow ShowWindow IsWindow OpenClipboard MessageBoxW IsWindowVisible SetWindowLongPtrW SetClipboardData DestroyMenu GetDlgCtrlID CallWindowProcW DefWindowProcW DestroyWindow GetWindowRect GetParent GetClientRect GetWindowLongW MonitorFromWindow GetDlgItem EndDialog SetWindowPos CreateWindowExW SendMessageW MapWindowPoints SetWindowTextW GetMonitorInfoW GetWindow CreatePopupMenu UnregisterClassA

gdi32

GetObjectW DeleteObject CreateFontIndirectW GetDeviceCaps GetClipBox CreatePatternBrush CreateRectRgn CombineRgn CreateRectRgnIndirect SelectClipRgn SelectObject PatBlt CreateBitmap

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW

shell32

ShellExecuteW

ole32

CoTaskMemFree CoTaskMemRealloc CoUninitialize CoCreateInstance CoInitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathRemoveFileSpecW

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

psapi

GetModuleFileNameExW GetMappedFileNameW EnumProcessModules GetProcessImageFileNameW

imagehlp

CheckSumMappedFile