learn1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
learn1.exe
Size 212KB
Sample260705-3bewdags4t
SHA256 4ee05c5e4ce5fed2e39450161fb9271656651c39da1705926c40f4567b80f920
MD5 8fc6850d6ac9594bb2b7872f6a92e9c7
SHA1 fdd72f3acf5bc4a46426120209ea5f5062d1ba01
SHA512 6a968b57391ef8e24aabc3eb41dd731adb022cdc151ed3be464a1246928bfa2a80666acc91345862cd88b468cd759242156ac5d745a3daaa07c307dc0116dfa1
SSDEEP 1536:9VKsUhKNgpVQDYFiEtgU9zDfzEMphQuk1f0ihlBQ080wWgl+lxRIPfk60N3hm:5zgQcFPLzDfzEMphQuKhhc080UlbjI3
TLSH
T185246B2BEA5850BED166D57CC9934D82EB72BC4A0751ABCF17904DE60F766C09F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
learn1.exe

File Explorer

learn1.exe

.exe 212KB

learn1.exe

IMPHASH ac9bf92abd3662cf3760a4b7cec68351
SHA256 4ee05c5e4ce5fed2e39450161fb9271656651c39da1705926c40f4567b80f920
MD5 8fc6850d6ac9594bb2b7872f6a92e9c7
SHA1 fdd72f3acf5bc4a46426120209ea5f5062d1ba01
SHA512 6a968b57391ef8e24aabc3eb41dd731adb022cdc151ed3be464a1246928bfa2a80666acc91345862cd88b468cd759242156ac5d745a3daaa07c307dc0116dfa1
SSDEEP 1536:9VKsUhKNgpVQDYFiEtgU9zDfzEMphQuk1f0ihlBQ080wWgl+lxRIPfk60N3hm:5zgQcFPLzDfzEMphQuKhhc080UlbjI3
TLSH
T185246B2BEA5850BED166D57CC9934D82EB72BC4A0751ABCF17904DE60F766C09F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetFilePointerEx GetModuleHandleW GetTempFileNameA FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW CloseHandle GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError CreateFileA GetTickCount64 GetTempPathA Sleep SetFilePointer GetDriveTypeA WriteFile FindNextFileW GetFileSizeEx GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter LocalFree

user32

FillRect ReleaseDC InvalidateRect PostQuitMessage GetClientRect TranslateMessage SetLayeredWindowAttributes CreateWindowExA RegisterClassA GetWindowLongA EndPaint PeekMessageW SetWindowLongA DispatchMessageW DefWindowProcW GetDC GetSystemMetrics BeginPaint

gdi32

CreateFontA SelectObject SetTextColor TextOutA SetBkMode DeleteObject CreateSolidBrush BitBlt

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_join _Thrd_detach _Thrd_id

winmm

PlaySoundA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset

api-ms-win-crt-stdio-l1-1-0

fgetpos setvbuf ungetc fgetc __stdio_common_vsprintf_s __p__commode fsetpos fclose fflush fread fputc _fseeki64 _get_stream_buffer_pointers _set_fmode fwrite

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argv exit _cexit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe _register_onexit_function _c_exit _initialize_onexit_table abort _crt_atexit _initterm_e _beginthreadex system terminate _register_thread_local_exe_atexit_callback _exit

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

log sin sqrt __setusermatherr tan cos

api-ms-win-crt-string-l1-1-0

strlen wcslen

Name

.text

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

learn1.exe

kernel32

user32

gdi32

msvcp140

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

generic