temp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
temp.exe
Size 73KB
Sample260708-v6wtdaey3v
SHA256 aa630f3db2ea4bb05d84499d83d724991be65c5418f1d7ce7a06e54619beef33
MD5 17200eac1227c433789ae721055752cf
SHA1 3ba937d8679754da0f54a71f9806287d8d7e87e3
SHA512 795cf43b4c246572a8f4688049fad17c07b15a5f61b5d9abc8e872ceea81263db70db551894f059ac530a24eb2068f85c4dd2516f87566e75111c9aad11fb97b
SSDEEP 768:/hNeOV+eONzUKN36aPADk3Gueziebzek3pUZ/EQv4qp4XotXwbrvG8p4FN9GQC8Z:iOqzbtYDwGNewcBwqp4686pp46
TLSH
T19973192E9C37506AC7A4CD7DC1261A41EB22BC8E4BD56BEB67C40CE50E269DC5F39903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
temp.exe

File Explorer

temp.exe

.exe 73KB

temp.exe

IMPHASH c50e6db8c2cc03f3f211b1e178afd672
SHA256 aa630f3db2ea4bb05d84499d83d724991be65c5418f1d7ce7a06e54619beef33
MD5 17200eac1227c433789ae721055752cf
SHA1 3ba937d8679754da0f54a71f9806287d8d7e87e3
SHA512 795cf43b4c246572a8f4688049fad17c07b15a5f61b5d9abc8e872ceea81263db70db551894f059ac530a24eb2068f85c4dd2516f87566e75111c9aad11fb97b
SSDEEP 768:/hNeOV+eONzUKN36aPADk3Gueziebzek3pUZ/EQv4qp4XotXwbrvG8p4FN9GQC8Z:iOqzbtYDwGNewcBwqp4686pp46
TLSH
T19973192E9C37506AC7A4CD7DC1261A41EB22BC8E4BD56BEB67C40CE50E269DC5F39903
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zen\Desktop\stuff\Trinity\Trinity Temp\tempdrv\x64\Release\temp.pdb

kernel32

CloseHandle Beep GetProcAddress Process32Next IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime Sleep CreateToolhelp32Snapshot GetModuleHandleA GetCurrentProcess ExitProcess Process32First RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId RtlCaptureContext

user32

MessageBoxA

advapi32

CryptGenRandom OpenProcessToken CryptReleaseContext GetTokenInformation CryptAcquireContextA

msvcp140

_Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context memmove

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment system _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback exit _invoke_watson _initialize_onexit_table _exit

api-ms-win-crt-stdio-l1-1-0

fclose __p__commode fwrite _set_fmode fgetc _get_stream_buffer_pointers fgetpos _fseeki64 fread fsetpos __stdio_common_vfprintf fflush ungetc __acrt_iob_func fopen fputc setvbuf fputs

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale