PAINTPILOT[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PAINTPILOT.exe
Size 7.2MB
Sample260710-har44aex5m
SHA256 0bf2384167cb15078f170a40bffc01f61f848ab5025b5c7c31ccb805a533cd39
MD5 98adea31959ac4ec4561292a9e2058c3
SHA1 537a53b103021d4bbf7352962135c37495458cc2
SHA512 5bbbec5cd03c81f4e9a37d573ae9536db9bfac841522dec74b185cf10aaf436b9731159378690c48e8ed388ddba22c53d68d3bb47fa4920e2a692c6cdd98e6b1
SSDEEP 49152:6ZC7VsGsDm95ftJFwPzKXTdj6/J2HEZlmLo+yfM62bP7xFvmfy3VNi5sDspaue5O:zH1a
TLSH
T14F768429E5102CD8E5E9D03A98AF734220B4355B4DE4BC5A731D4E0D9F7E22D1ABB70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PAINTPILOT.exe

File Explorer

PAINTPILOT.exe

.exe 7.2MB

PAINTPILOT.exe

IMPHASH 784ce730c5e16a3a4833952665f7f3e7
SHA256 0bf2384167cb15078f170a40bffc01f61f848ab5025b5c7c31ccb805a533cd39
MD5 98adea31959ac4ec4561292a9e2058c3
SHA1 537a53b103021d4bbf7352962135c37495458cc2
SHA512 5bbbec5cd03c81f4e9a37d573ae9536db9bfac841522dec74b185cf10aaf436b9731159378690c48e8ed388ddba22c53d68d3bb47fa4920e2a692c6cdd98e6b1
SSDEEP 49152:6ZC7VsGsDm95ftJFwPzKXTdj6/J2HEZlmLo+yfM62bP7xFvmfy3VNi5sDspaue5O:zH1a
TLSH
T14F768429E5102CD8E5E9D03A98AF734220B4355B4DE4BC5A731D4E0D9F7E22D1ABB70B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

425268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

HttpOpenRequestA InternetReadFile InternetConnectA InternetCloseHandle HttpSendRequestA InternetOpenA

ws2_32

htons inet_pton WSACleanup WSAStartup socket setsockopt send recv closesocket connect

user32

PeekMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW TranslateMessage UnregisterClassW LoadCursorA ScreenToClient MessageBoxW GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindow GetWindowThreadProcessId EnumWindows SetWindowLongW GetWindowLongW ClientToScreen CreateWindowExW GetClientRect GetWindowTextW SetForegroundWindow GetForegroundWindow UpdateWindow GetAsyncKeyState IsWindowVisible SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow DispatchMessageW

gdi32

CreateSolidBrush

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapFree HeapAlloc GetTimeZoneInformation GetCommandLineW GetCommandLineA IsValidCodePage GetFileType GetModuleHandleExW FreeLibraryAndExitThread SetEnvironmentVariableW ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError RtlUnwindEx RaiseException RtlPcToFileHeader ReadConsoleW OutputDebugStringW FindFirstFileExW InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetACP GetOEMCP GetEnvironmentStringsW WriteConsoleW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer Process32NextW GetStdHandle CompareFileTime CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileSize ReadFile RemoveDirectoryW WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle SetUnhandledExceptionFilter WaitForSingleObject GetCurrentProcess ExitProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread OpenProcess GetLocalTime GetTickCount VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetComputerNameA FreeConsole GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW RtlUnwind GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA WaitForSingleObjectEx Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime WakeAllConditionVariable EncodePointer

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

640KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PAINTPILOT.exe

wininet

ws2_32

user32

gdi32

advapi32

dwmapi

shell32

d3d11

d3dcompiler_47

kernel32

imm32

generic