TestApp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TestApp.exe
Size 98KB
Sample260705-t3db7ad12v
SHA256 0a13c29727b093749727354969d4b49c94e7db9c29b23761c93c1305746cb8e2
MD5 49bba1f0869358eff355e45cd265207f
SHA1 b8e7849576e0c04a9960bc4796c597b80dba780d
SHA512 45b33f03bd39aa242e5decbb57c03c5471741e0e094309d6d418f8d9bf9c95617ceef91ba1db2284d7027dd78be34a99bbd6ca10d97d2da2407ce63266bc7e0d
SSDEEP 1536:WR+3eQF4/yWGyIHEl2TJOSWpzzbD+q86hPaUVia+yfyGSQ81u5FCsSEhpy:PFZa2TJONXd5hiZa+yqv+FCsSEn
TLSH
T1ABA36C27DE1510BED35AD5B8CA525E02DB72B89507A1AFCF1B814DE20E069E8EF3F501
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TestApp.exe

File Explorer

TestApp.exe

.exe 98KB

TestApp.exe

IMPHASH 466f2b186314b90668d7a32ada8f50ea
SHA256 0a13c29727b093749727354969d4b49c94e7db9c29b23761c93c1305746cb8e2
MD5 49bba1f0869358eff355e45cd265207f
SHA1 b8e7849576e0c04a9960bc4796c597b80dba780d
SHA512 45b33f03bd39aa242e5decbb57c03c5471741e0e094309d6d418f8d9bf9c95617ceef91ba1db2284d7027dd78be34a99bbd6ca10d97d2da2407ce63266bc7e0d
SSDEEP 1536:WR+3eQF4/yWGyIHEl2TJOSWpzzbD+q86hPaUVia+yfyGSQ81u5FCsSEhpy:PFZa2TJONXd5hiZa+yqv+FCsSEn
TLSH
T1ABA36C27DE1510BED35AD5B8CA525E02DB72B89507A1AFCF1B814DE20E069E8EF3F501
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vd201\source\repos\TestApp\x64\Release\TestApp.pdb

kernel32

GlobalUnlock GetComputerNameA InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId ExitProcess GetSystemTimeAsFileTime MoveFileExW GlobalLock CloseHandle CreateFileA GetConsoleWindow GetLastError Sleep CreateMutexA GetModuleFileNameW WriteFile

user32

SetWindowsHookExW GetDC CallNextHookEx GetSystemMetrics GetKeyboardState ShowWindow OpenClipboard CloseClipboard ToAscii GetClipboardData UnhookWindowsHookEx ReleaseDC

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

msvcp140

?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Incref@facet@locale@std@@UEAAXXZ __crtLCMapStringA _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

winhttp

WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest

gdiplus

GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipGetImageEncodersSize GdipDisposeImage GdipFree GdipSaveImageToStream

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr __std_terminate __std_type_info_compare __std_exception_copy __std_exception_destroy memmove memcmp __RTtypeid memcpy _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset

api-ms-win-crt-heap-l1-1-0

_set_new_mode free realloc _callnewh malloc

api-ms-win-crt-string-l1-1-0

isdigit toupper strlen wcslen ispunct isupper isalnum islower

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _register_thread_local_exe_atexit_callback __p___argc __p___argv exit _exit terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _c_exit _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode