Expectional[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Expectional.exe
Size 2.4MB
Sample260705-wc2m7sew21
SHA256 5dd6f972f502c375c787494798c63fc56d20adb0e42a06415364990a891bd4df
MD5 2918d518315246bfb182c76dbc06a419
SHA1 71211c528bf3770328615e9b3ba8dcc31e67de61
SHA512 7a250bc224a6bc059b5a99080ee41e4157e0a4be6235fc8d2f75d2b087622e2828feb1dc9c41b062d3c494dc1bc434a96a5855a709a62e85645949dc4728972e
SSDEEP 49152:sK+EcV+GJbwNfRGLM4TFTuZ2ALNf4Sn3LwSqXvIuttYzPHst:sguGLQvttYzP
TLSH
T155C58D0161B06098C056E0B0C663E613D73534070724DADF77AFFA566F23DE29AFA69B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Expectional.exe

File Explorer

Expectional.exe

.exe 2.4MB

Expectional.exe

IMPHASH 17f9b8f2e514d889be4cda1d7c2579a7
SHA256 5dd6f972f502c375c787494798c63fc56d20adb0e42a06415364990a891bd4df
MD5 2918d518315246bfb182c76dbc06a419
SHA1 71211c528bf3770328615e9b3ba8dcc31e67de61
SHA512 7a250bc224a6bc059b5a99080ee41e4157e0a4be6235fc8d2f75d2b087622e2828feb1dc9c41b062d3c494dc1bc434a96a5855a709a62e85645949dc4728972e
SSDEEP 49152:sK+EcV+GJbwNfRGLM4TFTuZ2ALNf4Sn3LwSqXvIuttYzPHst:sguGLQvttYzP
TLSH
T155C58D0161B06098C056E0B0C663E613D73534070724DADF77AFFA566F23DE29AFA69B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1325152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlInitUnicodeString RtlAdjustPrivilege NtQuerySystemInformation NtUnloadDriver NtLoadDriver

winhttp

WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpWebSocketClose WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpWebSocketReceive

shell32

SHGetFolderPathW SHCreateDirectoryExW

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

shlwapi

UrlEscapeW

winmm

timeBeginPeriod timeEndPeriod PlaySoundA

kernel32

GetLocaleInfoEx FormatMessageA LocalFree InitOnceBeginInitialize InitOnceComplete GetFileInformationByHandleEx GetFileAttributesExW AreFileApisANSI CreateFile2 SetFileInformationByHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockShared AcquireSRWLockShared MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter ReadFile GetFileSizeEx WriteFile SetThreadPriority GetEnvironmentVariableW CreateFileW GetFileAttributesW GetCurrentThread GetThreadPriority CloseHandle SetLastError OpenFileMappingW UnmapViewOfFile Sleep GetLastError GetModuleHandleW CreateFileMappingW MapViewOfFile GetCurrentThreadId GetTickCount64 CreateThread ExitProcess GetTickCount SetConsoleTitleW DeviceIoControl GetCurrentProcessId K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW GetCurrentProcess VirtualFree VirtualAlloc GetModuleFileNameW GetTempPathW FindFirstFileA GetDriveTypeA K32GetModuleFileNameExW FindNextFileA FindClose OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW K32EnumProcessModules DeleteFileW MoveFileExW OutputDebugStringA FindFirstFileW FindNextFileW GetDriveTypeW GetModuleFileNameA CreateDirectoryW

user32

DefWindowProcW GetWindow GetWindowRect SetFocus DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetWindowDisplayAffinity EnumWindows SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow IsWindow SetForegroundWindow GetAncestor MessageBoxA GetMessageExtraInfo FindWindowA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData AttachThreadInput GetAsyncKeyState GetWindowLongPtrW GetWindowThreadProcessId GetDC BringWindowToTop SetWindowLongPtrW SetActiveWindow MapVirtualKeyW PostMessageW mouse_event GetKeyState

gdi32

GetDeviceCaps

advapi32

RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegOpenKeyExW RegSetKeyValueW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegCloseKey

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_join _Thrd_id ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??Bios_base@std@@QEBA_NXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z __crtLCMapStringA ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

avrt

AvSetMmThreadPriority AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

ws2_32

closesocket shutdown

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset wcsrchr wcsstr __std_exception_copy __std_exception_destroy strchr strstr __std_terminate __RTtypeid __current_exception __current_exception_context __C_specific_handler _CxxThrowException memchr memcmp memcpy memmove __std_type_info_compare

api-ms-win-crt-stdio-l1-1-0

ungetc fsetpos _fseeki64 setvbuf _get_stream_buffer_pointers __stdio_common_vswprintf __acrt_iob_func fflush fclose _set_fmode fseek _wfopen_s __stdio_common_vfprintf fgetpos fgetc __p__commode fputc getchar __stdio_common_vsnprintf_s fwrite _wfopen __stdio_common_vsprintf fread __stdio_common_vswprintf_s __stdio_common_vsscanf ftell

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc free _callnewh malloc

api-ms-win-crt-string-l1-1-0

tolower wcslen strncpy_s _wcsicmp isdigit _stricmp isalnum isspace _wcsnicmp strcmp strlen strncmp strncpy

api-ms-win-crt-convert-l1-1-0

strtoul strtol atof strtoll atoi strtod strtof

api-ms-win-crt-math-l1-1-0

sinf log lroundf logf __setusermatherr powf fmodf trunc llroundf truncf acosf fminf atan2f floorf ceilf fmaxf sqrtf ldexp llround _hypotf pow cosf

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate abort _errno _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_locale_name_func ___lc_codepage_func ___lc_collate_cp_func