Demo[.]mut[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Demo.mut.exe
Size 162KB
Sample260709-lp174af16l
SHA256 2598eb46152ff73d8fcfe39f852051171078b9b1200ef7c12143338191f1d1f4
MD5 1506b8a07bf51c826e652a9a6d3dac95
SHA1 e8da0a2a47b8a290c867c7a212fd63cf0e9d22d5
SHA512 82906a28ad330053a16a8ee0cc229dd97ec6a72d61633cd22b7fea3decf948d44e6d9754802656e1a1c094e3b8c92ab9564cdf7f27e0014d82fbcb6f228fe3b8
SSDEEP 3072:M01nWkBhLSB280G3+JWSefL2MyQZMSvnjmRXOsOKGFsGnBDxKrKu:/WUhpG3FHeSvKRXOL/BNtu
TLSH
T168F3D6102FCD01A5D5EF7B76D8D85252E2ABFC280E50E9BF35B225BDF43408A8589B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Demo.mut.exe

File Explorer

Demo.mut.exe

.exe 162KB

Demo.mut.exe

IMPHASH 9a8c917359f1ba558b4f6141418a9a0f
SHA256 2598eb46152ff73d8fcfe39f852051171078b9b1200ef7c12143338191f1d1f4
MD5 1506b8a07bf51c826e652a9a6d3dac95
SHA1 e8da0a2a47b8a290c867c7a212fd63cf0e9d22d5
SHA512 82906a28ad330053a16a8ee0cc229dd97ec6a72d61633cd22b7fea3decf948d44e6d9754802656e1a1c094e3b8c92ab9564cdf7f27e0014d82fbcb6f228fe3b8
SSDEEP 3072:M01nWkBhLSB280G3+JWSefL2MyQZMSvnjmRXOsOKGFsGnBDxKrKu:/WUhpG3FHeSvKRXOL/BNtu
TLSH
T168F3D6102FCD01A5D5EF7B76D8D85252E2ABFC280E50E9BF35B225BDF43408A8589B35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle WriteConsoleA ReadConsoleA RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetProcAddress FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException RtlCaptureContext IsProcessorFeaturePresent QueryPerformanceCounter GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId

vcruntime140

memset __current_exception_context __current_exception __C_specific_handler __vcrt_GetModuleFileNameW __C_specific_handler_noexcept __vcrt_LoadLibraryExW memcpy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table system terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _seh_filter_exe _exit exit _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _initterm_e _initterm _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s strcat_s

Name

.text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.mut

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pdata2

Size

1024B

Virtual Size

644B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Demo.mut.exe

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic