X48(1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
X48(1).exe
Size 2.7MB
Sample260714-bebvcaby6p
SHA256 93f98aea959d340717fc382b67f9b4d3cd7ae1e3f08d19e75c856e1f82276abd
MD5 e1ca045619d625376d0e2fd18fea6345
SHA1 10c95cd5bb5661e8c0d895e67602a13a633d10c6
SHA512 dd614a2b68ffd4d3d20a66150dd79829c3d7768447576717acebe8e232ba0856d1e498c7ac15a843e656cff466f283d17e254f24ce1ab6e7eec1a971ee44ca0d
SSDEEP 49152:7tGJoQCkdMSDzyVgY2LMWmMJgoT8+HEG/ykoVaplqeEKDVLMZ:7aCkzyuY6Okjpl1EKDVLM
TLSH
T12BD5BF83A3A101E8C536D03CC6479717E77278451320ABDB67D44AA66FA3AF06BFE351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
X48(1).exe

File Explorer

X48(1).exe

.exe 2.7MB

X48(1).exe

IMPHASH a9102ad75e8c616ec153bfa40224d36d
SHA256 93f98aea959d340717fc382b67f9b4d3cd7ae1e3f08d19e75c856e1f82276abd
MD5 e1ca045619d625376d0e2fd18fea6345
SHA1 10c95cd5bb5661e8c0d895e67602a13a633d10c6
SHA512 dd614a2b68ffd4d3d20a66150dd79829c3d7768447576717acebe8e232ba0856d1e498c7ac15a843e656cff466f283d17e254f24ce1ab6e7eec1a971ee44ca0d
SSDEEP 49152:7tGJoQCkdMSDzyVgY2LMWmMJgoT8+HEG/ykoVaplqeEKDVLMZ:7aCkzyuY6Okjpl1EKDVLM
TLSH
T12BD5BF83A3A101E8C536D03CC6479717E77278451320ABDB67D44AA66FA3AF06BFE351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1421288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\tryxz\Desktop\Wexize-V2-main\x64\Release\Wexize Revamp.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext WaitForMultipleObjects PeekNamedPipe RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileType VirtualProtect GetStdHandle CheckRemoteDebuggerPresent GetModuleHandleW GetSystemTimeAsFileTime GetEnvironmentVariableA GetCurrentProcessId WaitForSingleObjectEx MoveFileExA WriteProcessMemory CreateRemoteThreadEx QueryPerformanceCounter VerifyVersionInfoA FreeLibrary VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA GetLocaleInfoA WideCharToMultiByte GlobalFree MultiByteToWideChar SleepEx VirtualAlloc CreateThread EnterCriticalSection IsDebuggerPresent OpenThread GetStartupInfoW GetTickCount DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GetTickCount64 GetStartupInfoA GetProcAddress LoadLibraryA GetCommandLineA GetModuleHandleA GlobalUnlock DuplicateHandle GetProcessId TerminateProcess InitializeSListHead CreateRemoteThread ExitProcess SetLastError LocalFree GlobalLock Beep GlobalAlloc GetLastError Sleep GetCurrentProcess ReadProcessMemory VirtualProtectEx CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First HeapFree Module32Next Process32First VirtualFreeEx VirtualAllocEx HeapAlloc ReadFile GetFileSizeEx UnmapViewOfFile MapViewOfFile CreateFileA IsProcessorFeaturePresent CreateFileMappingA

user32

GetClipboardData SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard UpdateWindow SetClipboardData PostQuitMessage GetWindowLongPtrA PeekMessageA GetForegroundWindow SetLayeredWindowAttributes DefWindowProcA UnhookWindowsHookEx mouse_event FindWindowA GetAsyncKeyState MoveWindow MessageBoxA SetWindowsHookExA ShowWindow RegisterClassExW UnregisterClassW CallNextHookEx PostMessageA TranslateMessage DestroyWindow GetWindowRect GetWindowThreadProcessId IsWindowVisible GetWindowTextA EnumWindows FindWindowW SetWindowsHookA DispatchMessageA GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetWindowTextLengthA GetKeyState

advapi32

AdjustTokenPrivileges CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService OpenServiceA RevertToSelf CreateProcessAsUserA RegGetValueA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx ConvertSidToStringSidA OpenProcessToken CryptAcquireContextA

ole32

CoInitializeEx

msvcp140

?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ _Thrd_detach ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??1_Lockit@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency _Cnd_do_broadcast_at_thread_exit ??0_Lockit@std@@QEAA@H@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ws2_32

ntohl closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs

normaliz

IdnToAscii

crypt32

CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertGetNameStringA CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertCloseStore CertFindExtension

wldap32

ord22 ord26 ord27 ord32 ord50 ord35 ord79 ord30 ord200 ord301 ord41 ord33 ord143 ord60 ord211 ord46 ord217 ord45

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr __std_exception_destroy __std_exception_copy __std_terminate strstr strchr wcsstr

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode calloc malloc realloc

api-ms-win-crt-runtime-l1-1-0

_exit strerror _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _getpid _invalid_parameter_noinfo_noreturn _cexit _initterm_e __sys_nerr system _crt_atexit _configure_narrow_argv _errno _initterm exit _register_onexit_function _initialize_onexit_table terminate _beginthreadex _initialize_narrow_environment _get_narrow_winmain_command_line

api-ms-win-crt-string-l1-1-0

strncpy strncmp strcpy_s strcmp tolower strpbrk _stricmp strcspn strspn isupper _strdup toupper

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtol atof strtoll atoi strtod

api-ms-win-crt-math-l1-1-0

fmodf powf cosf sinf sqrt _dsign ceilf sqrtf atan2f _hypotf acosf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_open _close _write _read __stdio_common_vsprintf __p__commode _lseeki64 fputc fgets fflush _set_fmode feof fclose fputs fopen fgetc fwrite fgetpos __stdio_common_vsscanf _wfopen setvbuf ungetc __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 __stdio_common_vsprintf_s fread fsetpos

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _lock_file _fstat64 _access _stat64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64