untitled2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
untitled2.exe
Size 272KB
Sample260704-msvp6aev31
SHA256 5466d76108f701ea22421aef7deeb4c1162159ac8e4dfccc9b848114ce19872f
MD5 130b90918ffa348f3e94326571f9ab4c
SHA1 4122eaa3aed5a2707536522f789653e845df95b8
SHA512 333916019696499147f7595002f8aaf80d61c07b5e6ee24deccf643a215c7fcafccc14383ca0ff1c34fba1c10eb748244dd96716932670a833d1b209d2ed1774
SSDEEP 6144:37nHbuKUASJP5L5gve1g0m4bXtBHUWq+9yN86IpKIGl9AvXZq2qOqB9S9K99NpNk:3DtJ0m4bMJv+xZFXv
TLSH
T18E541AA373D51CDAD616527C45D7D7223739B9A05322AF1B0124EA321F03ED0AEDB62E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
untitled2.exe

File Explorer

untitled2.exe

.exe 272KB

untitled2.exe

IMPHASH 2a9f86e62310652c071350eb03425578
SHA256 5466d76108f701ea22421aef7deeb4c1162159ac8e4dfccc9b848114ce19872f
MD5 130b90918ffa348f3e94326571f9ab4c
SHA1 4122eaa3aed5a2707536522f789653e845df95b8
SHA512 333916019696499147f7595002f8aaf80d61c07b5e6ee24deccf643a215c7fcafccc14383ca0ff1c34fba1c10eb748244dd96716932670a833d1b209d2ed1774
SSDEEP 6144:37nHbuKUASJP5L5gve1g0m4bXtBHUWq+9yN86IpKIGl9AvXZq2qOqB9S9K99NpNk:3DtJ0m4bMJv+xZFXv
TLSH
T18E541AA373D51CDAD616527C45D7D7223739B9A05322AF1B0124EA321F03ED0AEDB62E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4389

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreatePen CreateSolidBrush DeleteObject Ellipse LineTo MoveToEx PatBlt SelectObject StretchBlt

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetProcessAffinityMask GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection MultiByteToWideChar OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _errno _endthreadex _fmode _initterm free memcmp memcpy memmove memset printf srand _onexit _time64 _ultoa _setjmp abort calloc exit fprintf fputc fputs fwrite getenv localeconv longjmp malloc rand realloc signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen _strdup

user32

DrawIcon FillRect GetCursorPos GetDC GetSystemMetrics InvalidateRect LoadIconA MessageBoxA ReleaseDC SetCursorPos ShowWindow

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

772B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1024B

Virtual Size

680B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

170B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

1024B

Virtual Size

978B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

untitled2.exe

gdi32

kernel32

msvcrt

user32

winmm

generic