x[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
x.exe
Size 40KB
Sample260713-vn28faet81
SHA256 4e2410060cf366fd4e604fe5a652208f7850e2954dd50a718ac5057de7109f35
MD5 4e00328d83d6bc593f14d188ef7f4fed
SHA1 920045826a9fc4f66c382026a21f392e27800a36
SHA512 25eab6ed58609aed566b076642cfe561955070f0096279e92054934f53b22a35e6fa73ece0754a50c3e91390330580b725c2401b3dfab461bed31c39b0a22481
SSDEEP 768:B8r7U2xZYnp/dAyiu8gthfWn+2z7O4htZSvR:GrZ25iul++2zSyPSvR
TLSH
T1F313D71ACE16A17BD35E8DB4CA470E05DE72BCC7CBE175CF67405CE50960AA4AB3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x.exe

File Explorer

x.exe

.exe 40KB

x.exe

IMPHASH 206da5bd1cba053072334a147334c290
SHA256 4e2410060cf366fd4e604fe5a652208f7850e2954dd50a718ac5057de7109f35
MD5 4e00328d83d6bc593f14d188ef7f4fed
SHA1 920045826a9fc4f66c382026a21f392e27800a36
SHA512 25eab6ed58609aed566b076642cfe561955070f0096279e92054934f53b22a35e6fa73ece0754a50c3e91390330580b725c2401b3dfab461bed31c39b0a22481
SSDEEP 768:B8r7U2xZYnp/dAyiu8gthfWn+2z7O4htZSvR:GrZ25iul++2zSyPSvR
TLSH
T1F313D71ACE16A17BD35E8DB4CA470E05DE72BCC7CBE175CF67405CE50960AA4AB3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\amazon\Desktop\valorant-injector-main\valorant-injector-main\build\hookloader.pdb

kernel32

RemoveDirectoryW GetTempPathW CreateFileW SetFileAttributesW DeleteFileW CloseHandle FreeLibrary GetTickCount LoadLibraryExW WriteFile GetProcAddress SetConsoleTitleW Sleep GetLastError CreateDirectoryW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW

user32

PostThreadMessageW UnhookWindowsHookEx FindWindowW GetWindowThreadProcessId SetWindowsHookExW

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z

dbghelp

ImageDirectoryEntryToData

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __std_exception_copy __std_exception_destroy __current_exception _CxxThrowException memset __C_specific_handler __std_terminate memcpy memmove

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table terminate _set_app_type _register_thread_local_exe_atexit_callback _register_onexit_function _c_exit _seh_filter_exe _cexit __p___wargv __p___argc system _exit exit _invoke_watson _initterm_e _initterm _get_initial_wide_environment _configure_wide_argv _initialize_wide_environment _crt_atexit

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale