HACKCSEXTERNO[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HACKCSEXTERNO.exe
Size 401KB
Sample260717-e4gzfaew3t
SHA256 fe51d49bb602a7b710cfc76cbe8f8e548f92b28c40f67bf6b6eb53621eb58d88
MD5 c23607178039f7693ad0ca53012b64b2
SHA1 144219b89c0a3af9b67d90c6989ed62232ed41ba
SHA512 82f689b96ab904f3048676193d16c5523244a7e26d1347afd2b829fbbdb5a6593d815d3717af43a3d94d37b8df9074ccc80bbfc8ef757f244c4b7a02bded4aa4
SSDEEP 6144:5nIGqWe1OvIV6c6mkIAEHQjgp7CetpoTdftkM7d3Ka2kgi4nZ7HC5E:53qWhsWzEfpHsTdFkyEaOi4nse
TLSH
T1FF949E45F1E444E8D02FA038D597BA1FEB35385C031055DBB7E859A82BE77F0AABA701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HACKCSEXTERNO.exe

File Explorer

HACKCSEXTERNO.exe

.exe 401KB

HACKCSEXTERNO.exe

IMPHASH 8c656a82990f66d52bdbfb4ebec05a3a
SHA256 fe51d49bb602a7b710cfc76cbe8f8e548f92b28c40f67bf6b6eb53621eb58d88
MD5 c23607178039f7693ad0ca53012b64b2
SHA1 144219b89c0a3af9b67d90c6989ed62232ed41ba
SHA512 82f689b96ab904f3048676193d16c5523244a7e26d1347afd2b829fbbdb5a6593d815d3717af43a3d94d37b8df9074ccc80bbfc8ef757f244c4b7a02bded4aa4
SSDEEP 6144:5nIGqWe1OvIV6c6mkIAEHQjgp7CetpoTdftkM7d3Ka2kgi4nZ7HC5E:53qWhsWzEfpHsTdFkyEaOi4nse
TLSH
T1FF949E45F1E444E8D02FA038D597BA1FEB35385C031055DBB7E859A82BE77F0AABA701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projetos Visual Studio\HACKCSEXTERNO\x64\Release\HACKCSEXTERNO.pdb

kernel32

GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle Module32FirstW Module32NextW FreeConsole InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar QueryPerformanceCounter AllocConsole GetCurrentProcess QueryPerformanceFrequency K32GetModuleInformation ReadProcessMemory VirtualQueryEx

user32

GetWindowThreadProcessId GetWindow IsWindowVisible EnumWindows GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout UpdateWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData ClientToScreen GetClientRect GetForegroundWindow RegisterHotKey RegisterClassA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage DispatchMessageA DestroyWindow GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA SendInput

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

shell32

ShellExecuteW

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??Bios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy strstr memchr memcmp __std_terminate memmove memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException memcpy

api-ms-win-crt-stdio-l1-1-0

_set_fmode freopen_s __acrt_iob_func __p__commode ftell fflush fclose __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek __stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _crt_atexit _cexit _seh_filter_exe _set_app_type _errno _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _configure_narrow_argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-string-l1-1-0

strcmp _wcsicmp strlen

api-ms-win-crt-math-l1-1-0

sqrtf sinf cosf atan2f ceilf fmodf sqrt __setusermatherr acosf pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale