tu3929[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tu3929.exe
Size 2.0MB
Sample260707-pd7saaew2q
SHA256 720a3c7352a4ebaa95565e234fec74865a2dbe4e90e5e9cb308c8575e21f6565
MD5 8ffcbd8a2d5b9429339ee1c0a3dc68f4
SHA1 c0b6f8e9391136a6d5377a2964607e74f6ff8133
SHA512 8ec1d810cc35c7655213cdd36fa5b3d8002e6d47f96d67e69d74f46e2886688c0dfdb1b68b504bb3842eb1e29137a666e6ab2ad9dd4cb866a369f5bb4765f2e4
SSDEEP 49152:zOOAToMTttOtLsUvaWNsOHSYpMaaU0OGYjflMY0X5k0WnvpKBqR8Xu:
TLSH
T17DA59E9DEE69168AFD7569C249EFB7994086BB223D014C36957C1E0847380FF74A382F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tu3929.exe

File Explorer

tu3929.exe

.exe 2.0MB

tu3929.exe

IMPHASH 9a8ed8c7d7ad2a34dbe2bff76e02a968
SHA256 720a3c7352a4ebaa95565e234fec74865a2dbe4e90e5e9cb308c8575e21f6565
MD5 8ffcbd8a2d5b9429339ee1c0a3dc68f4
SHA1 c0b6f8e9391136a6d5377a2964607e74f6ff8133
SHA512 8ec1d810cc35c7655213cdd36fa5b3d8002e6d47f96d67e69d74f46e2886688c0dfdb1b68b504bb3842eb1e29137a666e6ab2ad9dd4cb866a369f5bb4765f2e4
SSDEEP 49152:zOOAToMTttOtLsUvaWNsOHSYpMaaU0OGYjflMY0X5k0WnvpKBqR8Xu:
TLSH
T17DA59E9DEE69168AFD7569C249EFB7994086BB223D014C36957C1E0847380FF74A382F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject CreateMutexW Sleep GetCurrentProcess TerminateProcess CreateThread ResumeThread CreateProcessW VirtualAlloc VirtualFree VirtualAllocEx ReadProcessMemory WriteProcessMemory Wow64GetThreadContext Wow64SetThreadContext GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW lstrcatW lstrlenW MoveFileExW CloseHandle FreeConsole GetFileSize ReadFile FlushInstructionCache LoadLibraryA GetEnvironmentVariableW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GlobalMemoryStatusEx GetSystemInfo GetTickCount64 CreateDirectoryW GetFileAttributesW lstrcpyW CopyFileW GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetLastError IsDebuggerPresent CheckRemoteDebuggerPresent GetTempPathW WriteFile GetTempFileNameW DeleteFileW CreateFileW ExpandEnvironmentStringsW AllocConsole SetStdHandle IsProcessorFeaturePresent

user32

GetCursorPos MessageBoxW GetAsyncKeyState

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

ole32

CoInitializeEx CoUninitialize

oleaut32

VariantInit SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement

mscoree

CLRCreateInstance

shell32

SHGetFolderPathW

advapi32

RegCloseKey RegSetValueExW OpenProcessToken GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW

comctl32

InitCommonControlsEx