virus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
virus.exe
Size 1.2MB
Sample260716-phay4sgz21
SHA256 050e8d7370b7221e98c28d24f1c9a86b4d9f8471670cd2755beac9756fe771d2
MD5 ab62cca3c36b5594f52a8e88e392d746
SHA1 b8987f5f3bd24b36079fade02a79bb38bf3a8ce6
SHA512 fd6bba5131a60d7d849168ec773131150e92b11f66843539340a75dbf9c1f312a20b34f725b72ce90e64e1414d8265521d4a2950baee116de734a8eb050e5245
SSDEEP 24576:GJpPoc/p8xGsXgwxBFSGA4PEDSoSJ//CN4WaGjNhc61:6pPoZGUowsDFN4WaG/c
TLSH
T115453B17E26355ECC57FD17486579B72FA30B41941347E6E1AA8C7322F32E609B2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
virus.exe

File Explorer

virus.exe

.exe 1.2MB

virus.exe

IMPHASH 8581cd443fefe3c1097567731f6d3a5c
SHA256 050e8d7370b7221e98c28d24f1c9a86b4d9f8471670cd2755beac9756fe771d2
MD5 ab62cca3c36b5594f52a8e88e392d746
SHA1 b8987f5f3bd24b36079fade02a79bb38bf3a8ce6
SHA512 fd6bba5131a60d7d849168ec773131150e92b11f66843539340a75dbf9c1f312a20b34f725b72ce90e64e1414d8265521d4a2950baee116de734a8eb050e5245
SSDEEP 24576:GJpPoc/p8xGsXgwxBFSGA4PEDSoSJ//CN4WaGjNhc61:6pPoZGUowsDFN4WaG/c
TLSH
T115453B17E26355ECC57FD17486579B72FA30B41941347E6E1AA8C7322F32E609B2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegOpenKeyExW RegSetValueExW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteObject Ellipse LineTo MoveToEx SelectObject SetPixel StretchBlt

kernel32

CloseHandle CreateEventA CreateFileW CreateHardLinkW CreateRemoteThread CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FormatMessageA GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LocalFree MoveFileExW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_errno _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _chsize_s _close _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _wopen _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscat wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

shell32

ShellExecuteW

user32

FillRect GetDC GetSystemMetrics ShowWindow

Name

.text

Size

965KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

virus.exe

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

generic