swag[.]exe | Triage™

General

Target
swag.exe
Size 1.5MB
Sample260709-vrld4aet7r
SHA256 37d820586008e23767774a05f15c698bd09c42cd3b11da36ec672cc278023fd5
MD5 b9f6514609f10cb661e8dce2745f7ca4
SHA1 4c625957dfccd1b6f66d35110aad0142f70ff171
SHA512 772821e74078cf0d38707fa63db48c8df0e0bdfb20ddc8a7e00e76167d10c076ad28c872a22448e6ee25db2d4dd3ea69520045d1b4a81abecdba7a8540762a49
SSDEEP 24576:Zb6pbIrEJIrRJtA4Wj2lIjfOivBE7eIWxEuzAmjT9f+usx:VVrJrTc2yfJCKI2vz19
TLSH
T11E654B1EC6F62AC0D0BECCF76D836D658C912F95013C364EDAB0F26245710E269DADA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
swag.exe

File Explorer

swag.exe

.exe 1.5MB

swag.exe

IMPHASH c5e134cc1c1e4c253962fc1102568c64
SHA256 37d820586008e23767774a05f15c698bd09c42cd3b11da36ec672cc278023fd5
MD5 b9f6514609f10cb661e8dce2745f7ca4
SHA1 4c625957dfccd1b6f66d35110aad0142f70ff171
SHA512 772821e74078cf0d38707fa63db48c8df0e0bdfb20ddc8a7e00e76167d10c076ad28c872a22448e6ee25db2d4dd3ea69520045d1b4a81abecdba7a8540762a49
SSDEEP 24576:Zb6pbIrEJIrRJtA4Wj2lIjfOivBE7eIWxEuzAmjT9f+usx:VVrJrTc2yfJCKI2vz19
TLSH
T11E654B1EC6F62AC0D0BECCF76D836D658C912F95013C364EDAB0F26245710E269DADA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey GetUserNameA RegCreateKeyExA

kernel32

GetConsoleOutputCP SetFilePointerEx GetConsoleMode CreateFileW WriteConsoleW HeapSize FlushFileBuffers IsProcessorFeaturePresent GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA WriteFile GetTempPathA GetTempFileNameA CloseHandle Sleep GetModuleFileNameA GetModuleHandleA GetProcAddress CopyFileA GetComputerNameA GetModuleHandleW VirtualAlloc VirtualProtect AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetCurrentThread GetThreadContext SetThreadContext WaitForSingleObject GetExitCodeProcess CreateProcessA MultiByteToWideChar FreeLibrary GetCurrentProcessId GetTickCount GetFileSize ReadFile GetCurrentProcess LoadLibraryA GetTickCount64 WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree GetLastError LocalFree GetProcessHeap LCMapStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

swag.exe

ole32

oleaut32

advapi32

kernel32

generic