ExoPanda (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ExoPanda (1).exe
Size 89.5MB
Sample260714-ar928sdv7x
SHA256 a28895ff0b86d9a73538ca83a6d919713c7214e2e89014787fa9b3994a1277cb
MD5 623cf90daf80d0df154c089d421fb179
SHA1 87ad25dc043a04a8c06332fcf0bdfb2d02b9f7eb
SHA512 ddcc77e72de6d85c1ad3ffd66a979c58a8897e4a53e5065f794b3697e74e87b2b12d2fa50f98a79d1381494730b7a31320ae83f4483125beaf17be7835bff4bc
SSDEEP 1572864:2DtPvKxhT1FgcW/JCkT0WhosMZT0wYFtRmECOfWHcqj3Ai:StPSxhpucA1T7oeY9IWrH
TLSH
T184281207E2A940E8D4AEC0B8C7575637EBB278490730A6EF16E44A652F27FE05B3D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExoPanda (1).exe

File Explorer

ExoPanda (1).exe

.exe 89.5MB

ExoPanda (1).exe

IMPHASH f3a8e7f12b321679e44f37461793407f
SHA256 a28895ff0b86d9a73538ca83a6d919713c7214e2e89014787fa9b3994a1277cb
MD5 623cf90daf80d0df154c089d421fb179
SHA1 87ad25dc043a04a8c06332fcf0bdfb2d02b9f7eb
SHA512 ddcc77e72de6d85c1ad3ffd66a979c58a8897e4a53e5065f794b3697e74e87b2b12d2fa50f98a79d1381494730b7a31320ae83f4483125beaf17be7835bff4bc
SSDEEP 1572864:2DtPvKxhT1FgcW/JCkT0WhosMZT0wYFtRmECOfWHcqj3Ai:StPSxhpucA1T7oeY9IWrH
TLSH
T184281207E2A940E8D4AEC0B8C7575637EBB278490730A6EF16E44A652F27FE05B3D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4843456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ExoPanda.pdb

shell32

SHGetKnownFolderPath ShellExecuteW SHCreateItemFromParsingName Shell_NotifyIconW DragQueryFileW DragFinish SHAppBarMessage Shell_NotifyIconGetRect

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoUninitialize OleInitialize CoCreateFreeThreadedMarshaler CoCreateInstance RevokeDragDrop RegisterDragDrop

kernel32

lstrlenW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP CompareStringOrdinal GetSystemDirectoryW GetStdHandle WriteConsoleW MultiByteToWideChar QueryPerformanceFrequency ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW FindClose FindFirstFileExW DeleteFileW SwitchToThread GetFileInformationByHandleEx GetFinalPathNameByHandleW CreateDirectoryW MoveFileExW CopyFileExW LoadLibraryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SleepEx GetCurrentThread SetThreadStackGuarantee CreateThread AddVectoredExceptionHandler DuplicateHandle GetWindowsDirectoryW SetFileInformationByHandle SetFilePointerEx CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapReAlloc FormatMessageW HeapAlloc CreateProcessW WriteFileEx GetEnvironmentVariableW HeapFree GetProcessHeap WaitForSingleObject ReadFileEx GetPackageFullName Process32NextW Process32FirstW CreateToolhelp32Snapshot FreeLibrary LoadLibraryExA SetThreadErrorMode OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW GetSystemTimePreciseAsFileTime LCIDToLocaleName SetLastError GetUserDefaultUILanguage SetFileCompletionNotificationModes GetCurrentThreadId CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReleaseMutex QueryPerformanceCounter FreeEnvironmentStringsW GetModuleHandleW ReleaseSRWLockExclusive GetSystemInfo GetProcessId CancelIoEx WriteFile RtlCaptureContext ReadFile CreateMutexW GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode DeleteCriticalSection SetNamedPipeHandleState GetOverlappedResult SetHandleInformation RtlLookupFunctionEntry RtlVirtualUnwind SetFileTime AcquireSRWLockExclusive FindNextFileW WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime TerminateProcess GetExitCodeProcess RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue QueryFullProcessImageNameW OpenProcess FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx GetModuleHandleA Sleep CloseHandle GetLastError GetProcAddress InitializeCriticalSectionEx LoadLibraryA

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 EventUnregister EventWriteTransfer EventSetInformation EventRegister RegOpenKeyExW RegGetValueW RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyTransactedW RegEnumKeyExW RegQueryValueExW RegDeleteValueW RegSetValueExW RegCloseKey RegDeleteTreeW

ntdll

RtlGetVersion NtWriteFile NtCreateFile NtCreateNamedPipeFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCancelIoFileEx NtReadFile

user32

KillTimer DestroyIcon CreateIcon RegisterRawInputDevices DrawTextW GetRawInputData SetPropW SystemParametersInfoA GetAsyncKeyState GetKeyboardState EnumDisplayMonitors SetWindowTextW GetWindowTextW DestroyWindow GetMessageA TranslateMessage DispatchMessageA GetWindowTextLengthW SetWindowDisplayAffinity SetWindowPlacement ChangeDisplaySettingsExW SendInput GetMenu MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx PostQuitMessage GetKeyState SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor AdjustWindowRect SetTimer ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SetParent InsertMenuW AppendMenuW RedrawWindow PostMessageW RegisterClassW MapWindowPoints SetFocus DestroyAcceleratorTable CreateAcceleratorTableW EnableWindow IsWindowEnabled GetMenuItemInfoW IsProcessDPIAware GetParent FindWindowExW SetWindowRgn GetWindowPlacement TrackMouseEvent GetClientRect GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect InvalidateRgn SetMenuItemInfoW RegisterTouchWindow IsWindow AdjustWindowRectEx FillRect MonitorFromRect CloseTouchInputHandle SystemParametersInfoW ClientToScreen GetSystemMetrics DrawMenuBar GetWindowLongW GetTouchInputInfo SetCursor LoadCursorW FlashWindowEx SetMenu GetMenuBarInfo CreateMenu CreatePopupMenu DrawIconEx CheckMenuItem RemoveMenu DestroyMenu FindWindowW OffsetRect TrackPopupMenu IsImmersiveProcess GetWindow MonitorFromPoint GetMonitorInfoW EnumWindows GetWindowThreadProcessId IsWindowVisible GetDC ReleaseDC GetCursorPos ScreenToClient SetWindowPos IsIconic ShowWindow SetForegroundWindow GetWindowRect SetCursorPos EnumDisplaySettingsW MonitorFromWindow RegisterClassExW CreateWindowExW SetWindowLongPtrW GetWindowLongPtrW ChangeWindowMessageFilterEx TranslateAcceleratorW SendMessageW DefWindowProcW MapVirtualKeyW GetWindowDC EnumChildWindows GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect DispatchMessageW GetMessageW RegisterWindowMessageA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

gdi32

CreateRectRgn SelectObject DeleteDC GetDIBits BitBlt CreateSolidBrush SetTextColor SetBkMode CreateCompatibleBitmap CreateDIBSection DeleteObject CreateCompatibleDC GetDeviceCaps CombineRgn

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

shlwapi

SHCreateMemStream

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

ws2_32

setsockopt WSASend bind connect WSASocketW shutdown ioctlsocket getsockname getpeername WSAGetLastError send WSAIoctl WSACleanup WSAStartup freeaddrinfo getaddrinfo getsockopt recv closesocket

secur32

QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW EncryptMessage AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext ApplyControlToken FreeCredentialsHandle AcceptSecurityContext

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertFreeCertificateChain CertCloseStore CertOpenStore CertDuplicateStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertAddCertificateContextToStore CertGetCertificateChain CertEnumCertificatesInStore

iphlpapi

GetExtendedTcpTable

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

sinf expf roundf floorf __setusermatherr atan2f trunc ceilf round floor pow

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcslen wcscmp _wcsicmp

api-ms-win-crt-heap-l1-1-0

free calloc malloc _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

abort _initterm_e _initterm exit terminate _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _crt_atexit _register_onexit_function _initialize_onexit_table _exit __p___argc _configure_narrow_argv __p___argv _cexit _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale