optimaze[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
optimaze.exe
Size 10.5MB
Sample260705-yr2mvsft8x
SHA256 9c2231da6269a5ccc401ab46a9b3778097d6c7a48d207ed7281cb31a30abb6a0
MD5 5852b2fe807d9ff51d820442c97b5899
SHA1 14f35f61c725d16e55b2a4e48c6f21591909034e
SHA512 dfe56d28ab10525d86a6708fef27a004095f6445c1fd00012e6338b5b5f46d61e72e2f767620e8e8ca4e3c133c620d8b1889c1fb681813ef2a5669e604f7c61c
SSDEEP 49152:ynXnHkK4L5IaP5yi2YnDyIVmPg5HUrc1ioZbJ/1zFa9MlFHF3ZItfCjjBOx/W3K1:SBSorcAw7ZzaOyUJFrLbN6SsDj6Afg+
TLSH
T14CB60916A779A0DDD17FC07892839B22BD21749907393BF34AD1866A1F20EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
optimaze.exe

File Explorer

optimaze.exe

.exe 10.5MB

optimaze.exe

IMPHASH c83eef7910a2d0c5d267f1a3ece4ee28
SHA256 9c2231da6269a5ccc401ab46a9b3778097d6c7a48d207ed7281cb31a30abb6a0
MD5 5852b2fe807d9ff51d820442c97b5899
SHA1 14f35f61c725d16e55b2a4e48c6f21591909034e
SHA512 dfe56d28ab10525d86a6708fef27a004095f6445c1fd00012e6338b5b5f46d61e72e2f767620e8e8ca4e3c133c620d8b1889c1fb681813ef2a5669e604f7c61c
SSDEEP 49152:ynXnHkK4L5IaP5yi2YnDyIVmPg5HUrc1ioZbJ/1zFa9MlFHF3ZItfCjjBOx/W3K1:SBSorcAw7ZzaOyUJFrLbN6SsDj6Afg+
TLSH
T14CB60916A779A0DDD17FC07892839B22BD21749907393BF34AD1866A1F20EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6965408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

optimaze.pdb

kernel32

GetProcessIoCounters GetCurrentProcessId GetExitCodeProcess GetProcessTimes GetSystemTimes WaitForSingleObject OpenProcess HeapAlloc HeapFree VirtualQueryEx GetCurrentThreadId GetProcessHeap ReadProcessMemory CreateEventW GlobalFree LocalFree FormatMessageW GlobalMemoryStatusEx LoadLibraryExA GetSystemInfo FindNextFileW QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW LoadLibraryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread GetConsoleOutputCP GetStdHandle GlobalLock GlobalAlloc SetLastError GlobalUnlock WriteConsoleW GlobalSize WideCharToMultiByte CancelIo ReadFile QueryPerformanceFrequency MultiByteToWideChar GetCurrentThread CreateFileW ExitProcess K32GetPerformanceInfo GetFullPathNameW GetModuleHandleW GetConsoleMode FindClose FindFirstFileExW DeleteFileW GetFileInformationByHandle GetOverlappedResult SwitchToThread GetFileInformationByHandleEx GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler DuplicateHandle SetFileTime SetFileInformationByHandle GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleA Sleep GetLastError ReleaseMutex CreateMutexA WaitForSingleObjectEx lstrlenW HeapReAlloc CloseHandle SetUnhandledExceptionFilter LoadLibraryA GetModuleFileNameW SetThreadErrorMode LoadLibraryExW GetProcAddress FreeLibrary

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlNtStatusToDosError NtReadFile NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion

advapi32

CopySid ImpersonateAnonymousToken RevertToSelf IsValidSid GetTokenInformation OpenProcessToken EnumServicesStatusExW CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW GetLengthSid

oleaut32

SysAllocStringLen GetErrorInfo SetErrorInfo SysFreeString SysStringLen SafeArrayCreateVector VariantClear SafeArrayPutElement

psapi

GetModuleFileNameExW

shell32

DragQueryFileW DragFinish CommandLineToArgvW

ole32

RegisterDragDrop CoInitializeEx CoCreateInstance CoUninitialize OleInitialize RevokeDragDrop

powrprof

CallNtPowerInformation

pdh

PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter PdhEnumObjectsA PdhOpenQueryA PdhCloseQuery PdhAddEnglishCounterW

user32

SetClipboardData CloseClipboard CreateIcon MonitorFromPoint GetClipboardData IsClipboardFormatAvailable OpenClipboard EmptyClipboard FlashWindowEx SetCursorPos GetSystemMenu SetWindowPos ClientToScreen GetForegroundWindow SystemParametersInfoA AdjustWindowRectEx SetPropW CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetClassNameW GetWindowPlacement GetPropW GetDC RegisterWindowMessageA RemovePropW RegisterRawInputDevices CallWindowProcW GetAsyncKeyState SetCapture ReleaseCapture GetWindowLongPtrW MsgWaitForMultipleObjectsEx EnumDisplayMonitors GetWindowLongW GetClientRect SetWindowLongW RegisterClipboardFormatW ShowWindow SetWindowLongPtrW RedrawWindow CreateIconFromResourceEx SendMessageW GetWindowRect IsIconic DestroyCursor GetSystemMetrics GetActiveWindow ReleaseDC PostMessageW DispatchMessageW TranslateMessage PeekMessageW DestroyWindow DestroyIcon GetKeyboardState ShowCursor EnableMenuItem ClipCursor GetClipCursor MonitorFromRect TrackMouseEvent GetMenu GetTouchInputInfo CloseTouchInputHandle ScreenToClient LoadCursorW SetCursor GetWindowTextLengthW MonitorFromWindow GetWindowTextW SetWindowTextW RegisterTouchWindow GetCursorPos GetMonitorInfoW ValidateRect MapVirtualKeyExW ToUnicodeEx GetKeyboardLayout GetKeyState MapVirtualKeyW SendInput SetForegroundWindow ChangeDisplaySettingsExW SetWindowPlacement SetWindowDisplayAffinity IsProcessDPIAware GetRawInputData InvalidateRgn

gdi32

SetPixelFormat DeleteObject DescribePixelFormat SwapBuffers ChoosePixelFormat GetDeviceCaps CreateRectRgn

opengl32

wglCreateContext wglMakeCurrent wglGetProcAddress wglShareLists wglGetCurrentDC wglGetCurrentContext wglDeleteContext

shlwapi

AssocQueryStringW

uiautomationcore

UiaHostProviderFromHwnd UiaRaiseAutomationEvent UiaLookupId UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue

imm32

ImmAssociateContextEx ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

memcmp memmove _CxxThrowException memcpy __current_exception_context memset __CxxFrameHandler3 __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

roundf fmod atan2f acosf cos cbrtf cosf trunc floor _hypotf truncf floorf powf ceilf sinf expf round __setusermatherr sin

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _configure_narrow_argv _initialize_onexit_table _register_onexit_function _set_app_type _seh_filter_exe _crt_atexit terminate _register_thread_local_exe_atexit_callback strerror _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale