TOHEART2[.]EXE | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TOHEART2.EXE
Size 2.3MB
Sample260712-ds7v2scv2p
SHA256 a4efc4166c4e29cfd8333aed971854013364849e462673cc300735a8402f503f
MD5 0c01bcc73059a219c5945d51fb643fa4
SHA1 92f39e2fd473c14f8f7619924ef7658a491293aa
SHA512 2ac81df1aef1de72b5f6a9d56c32e653e2c1ce1ef205190bb03117299a2ed0294313671aa9672a0990e441a850c71d93135cc0456785e326ec05086cd19a6e2d
SSDEEP 24576:yTrXcJebIxOJOXcPZfLtdbawbt7o9qqHrn2On9tr+T3dmKQPOvTOAseqt7lZClu2:I844XWZf/Bbt8mIbnuAfP/uK1
TLSH
T119B54C11E792D01BF4C210B5A6E992F5A8383731578810E3B7D45EEDB63AAD19E3072F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TOHEART2.EXE

File Explorer

TOHEART2.EXE

.exe 2.3MB

TOHEART2.EXE

IMPHASH 317b188596a8c4e344164d9fb81bf8a8
SHA256 a4efc4166c4e29cfd8333aed971854013364849e462673cc300735a8402f503f
MD5 0c01bcc73059a219c5945d51fb643fa4
SHA1 92f39e2fd473c14f8f7619924ef7658a491293aa
SHA512 2ac81df1aef1de72b5f6a9d56c32e653e2c1ce1ef205190bb03117299a2ed0294313671aa9672a0990e441a850c71d93135cc0456785e326ec05086cd19a6e2d
SSDEEP 24576:yTrXcJebIxOJOXcPZfLtdbawbt7o9qqHrn2On9tr+T3dmKQPOvTOAseqt7lZClu2:I844XWZf/Bbt8mIbnuAfP/uK1
TLSH
T119B54C11E792D01BF4C210B5A6E992F5A8383731578810E3B7D45EEDB63AAD19E3072F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1718384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Public\Documents\toheart2\ToHeart2\ScriptEngine\Debug\ScriptEngine.pdb

ddraw

DirectDrawCreateEx DirectDrawEnumerateA

avifil32

AVIFileInfoA AVIFileOpenA AVIFileInit AVIFileGetStream AVIFileRelease AVIStreamGetFrameClose AVIStreamGetFrameOpen AVIStreamRead AVIStreamInfoA AVIStreamReadFormat AVIStreamGetFrame AVIFileExit

msacm32

acmStreamOpen acmStreamSize acmFormatSuggest acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmStreamClose

dsound

ord2 ord11

winmm

timeGetTime timeEndPeriod timeBeginPeriod timeGetDevCaps PlaySoundA

comctl32

ord17

kernel32

RemoveDirectoryA FindClose FindNextFileA FindFirstFileA CreateDirectoryA GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA WritePrivateProfileStructA GetPrivateProfileStructA GetVersionExA MultiByteToWideChar lstrlenA lstrcpyA HeapAlloc GetFileAttributesA CreateThread CreateEventA ExitThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects InitializeCriticalSection WaitForSingleObject CreateProcessA SearchPathA GetDriveTypeA FileTimeToSystemTime GetFileTime GetLastError CreateMutexA GetCurrentThreadId GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapDestroy HeapCreate HeapQueryInformation HeapSize HeapReAlloc GetModuleFileNameA SetConsoleCtrlHandler OutputDebugStringW GetFileType WriteConsoleW GetStdHandle FatalAppExitA InitializeCriticalSectionAndSpinCount FreeLibrary VirtualQuery GetCurrentThread SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetCPInfo GetOEMCP GetACP LCMapStringW IsProcessorFeaturePresent ExitProcess GetModuleHandleW InterlockedDecrement InterlockedIncrement GetStartupInfoW HeapSetInformation GetCommandLineA IsBadReadPtr HeapValidate GetModuleFileNameW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess CreateFileW TerminateProcess RtlUnwind DecodePointer EncodePointer LoadLibraryW GetProcAddress RaiseException IsDebuggerPresent WideCharToMultiByte FormatMessageA LocalFree OutputDebugStringA GetProcessHeap HeapFree Sleep GetLocalTime GetModuleHandleA CopyFileA lstrcmpiA GetFileSize SetFilePointer ReadFile CreateFileA WriteFile CloseHandle GlobalAlloc GlobalFree GetEnvironmentStringsW SetHandleCount GetConsoleCP GetConsoleMode InterlockedExchange GetLocaleInfoW GetStringTypeW SetStdHandle FlushFileBuffers GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID SetEndOfFile FreeEnvironmentStringsW

user32

UnregisterClassA DispatchMessageA TranslateMessage WaitForInputIdle TranslateAcceleratorA GetMessageA PeekMessageA SetFocus SetTimer KillTimer BeginPaint EndPaint PostQuitMessage DefWindowProcA LoadIconA LoadCursorA RegisterClassA CheckMenuItem CreatePopupMenu GetSubMenu EnumDisplaySettingsA ChangeDisplaySettingsA WINNLSEnableIME GetDlgItemTextA EnableWindow SetDlgItemTextA UpdateWindow EndDialog ShowCursor ClientToScreen SetCursorPos GetCursorPos ScreenToClient GetSystemMetrics IsWindowVisible GetWindowRect GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SetForegroundWindow FindWindowA DialogBoxParamA SendMessageA EnableMenuItem GetAsyncKeyState SetWindowPos CreateDialogParamA ShowWindow DestroyWindow MessageBoxA LoadBitmapA wvsprintfA DeleteMenu InsertMenuA GetMenu ModifyMenuA DrawMenuBar SendDlgItemMessageA wsprintfA GetDC ReleaseDC GetClientRect SetWindowTextA LoadAcceleratorsA GetDlgItem CreateWindowExA

gdi32

CreateFontA StretchBlt GetDeviceCaps TextOutA BitBlt SetBkColor CreateCompatibleDC DeleteObject CreateDIBSection SelectObject GetStockObject DeleteDC PatBlt CreateSolidBrush SetPixel GetPixel CreatePalette GetSystemPaletteEntries SetPaletteEntries SelectPalette SetTextColor RealizePalette

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegCreateKeyExA

shell32

SHGetPathFromIDListA ShellExecuteA SHGetMalloc SHBrowseForFolderA

ole32

CoUninitialize CoCreateInstance CoInitialize

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

85KB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TOHEART2.EXE

ddraw

avifil32

msacm32

dsound

winmm

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic