79af011e0c[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
79af011e0c.exe
Size 17.1MB
Sample260703-aecafagx81
SHA256 4bb34e598d7b50ab09395a62e2fa20bcfe02a0eb67bff659c90eac2c1a103649
MD5 7704f775a3a7acaa4804a36def986eff
SHA1 91746617df3658a3c32197e7f00b72cf37bff11e
SHA512 badeee99bab8cbefdd29832e009e2a40bda156ef90a3a56d2ccc8c7e4d9101c52a25e4cf3d29b1888e51f8d1df6f63a5c497f24f7429367dbe59abb4a0de155f
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK94110:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgK
TLSH
T1C4074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79af011e0c.exe

File Explorer

79af011e0c.exe

.exe 17.1MB

79af011e0c.exe

IMPHASH bc2613f38b98bc1b84e1d4b2baaec62d
SHA256 4bb34e598d7b50ab09395a62e2fa20bcfe02a0eb67bff659c90eac2c1a103649
MD5 7704f775a3a7acaa4804a36def986eff
SHA1 91746617df3658a3c32197e7f00b72cf37bff11e
SHA512 badeee99bab8cbefdd29832e009e2a40bda156ef90a3a56d2ccc8c7e4d9101c52a25e4cf3d29b1888e51f8d1df6f63a5c497f24f7429367dbe59abb4a0de155f
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK94110:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgK
TLSH
T1C4074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3165616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CheckTokenMembership DeregisterEventSource DuplicateTokenEx GetTokenInformation ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf

bcrypt

BCryptGetProperty BCryptGenRandom BCryptEncrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptSetProperty BCryptDestroyHash BCryptImportKey BCryptImportKeyPair BCryptDestroyKey BCryptHashData BCryptExportKey

crypt32

PFXImportCertStore PFXExportCertStore CryptQueryObject CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertSerializeCertificateStoreElement CertSaveStore CertOpenStore CertNameToStrW CertGetValidUsages CertGetNameStringW CertGetIntendedKeyUsage CertAddCertificateContextToStore CertAddCertificateLinkToStore CertCloseStore CertControlStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty

iphlpapi

GetNetworkParams GetAdaptersAddresses GetPerAdapterInfo if_nametoindex

kernel32

SetUnhandledExceptionFilter RtlUnwindEx InitializeSListHead RtlPcToFileHeader RaiseException FlsFree EncodePointer K32GetProcessMemoryInfo GetProcessGroupAffinity CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FindClose FindFirstFileExW FlushFileBuffers FlushViewOfFile FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemInfo GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile ResetEvent ResumeThread SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleOutputCP SetConsoleTitleW SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber

ncrypt

NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptDeleteKey

ole32

CoCreateGuid CoGetApartmentType CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles

ws2_32

WSAStartup WSASocketW WSASend bind ioctlsocket WSARecv WSAIoctl WSAGetOverlappedResult WSAEventSelect WSAConnect WSACleanup GetNameInfoW GetAddrInfoW shutdown setsockopt send select recv closesocket getsockopt getpeername FreeAddrInfoExW FreeAddrInfoW GetAddrInfoExW

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr modf floor ceil

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp _stricmp strlen

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit __p___wargv __p___argc abort _exit _register_thread_local_exe_atexit_callback terminate exit _initterm_e _crt_atexit _initterm _register_onexit_function _c_exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale