re[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
re.exe
Size 133.1MB
Sample260718-afrfrahy7p
SHA256 783d309f9a4bfbeb734033a513add9a9f2ec939aaed31c2b49579e9ba75ba083
MD5 14169b68ac592181eddfb6ec9e828dea
SHA1 0068c0e832c856b7fa3aec367eda5413232aef5d
SHA512 215cef33539151f95c1d5a27bdd8fbb33db4dfaf067139d5292590d57db55f7968e2d86704c394847750edefc4a9e05840584a5b25621dfc4df2e782bc70d411
SSDEEP 3145728:r9dY99ZgaRUlcRrT6BsZVYbI5N8j09ZZZjZZZrBQ:DQ9ZvRGRbnj09ZZZjZZZrS
TLSH
T15F68334ECECD7D7BC40B263E9846FDAE76DA74C12B75A9712200CED5656E260083DF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
re.exe

File Explorer

re.exe

.exe 133.1MB

re.exe

IMPHASH d476da3bf687e5b8a70d42eba73d50b5
SHA256 783d309f9a4bfbeb734033a513add9a9f2ec939aaed31c2b49579e9ba75ba083
MD5 14169b68ac592181eddfb6ec9e828dea
SHA1 0068c0e832c856b7fa3aec367eda5413232aef5d
SHA512 215cef33539151f95c1d5a27bdd8fbb33db4dfaf067139d5292590d57db55f7968e2d86704c394847750edefc4a9e05840584a5b25621dfc4df2e782bc70d411
SSDEEP 3145728:r9dY99ZgaRUlcRrT6BsZVYbI5N8j09ZZZjZZZrBQ:DQ9ZvRGRbnj09ZZZjZZZrS
TLSH
T15F68334ECECD7D7BC40B263E9846FDAE76DA74C12B75A9712200CED5656E260083DF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose FindFirstFileA GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter IsBadWritePtr HeapReAlloc GetPrivateProfileStringA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetVersion GetCommandLineA GetStartupInfoA GetModuleHandleA MoveFileA SetFileAttributesA DeleteFileA GetFileAttributesA TerminateProcess ExitProcess RaiseException SetCurrentDirectoryA GetCurrentDirectoryA SetEnvironmentVariableA CreateDirectoryA HeapFree HeapAlloc HeapCompact HeapSize RtlUnwind GetModuleFileNameA GetDriveTypeA GetVersionExA GetCurrentProcess MoveFileExA GetShortPathNameA GetLastError WritePrivateProfileStringA GetTempPathA SetFileTime GetWindowsDirectoryA GetSystemDirectoryA GetFullPathNameA GlobalHandle lstrcatA WinExec LoadLibraryA GetProcAddress FreeLibrary GetDiskFreeSpaceA GlobalAlloc GlobalLock GlobalUnlock GlobalFree CloseHandle SetFilePointer WriteFile ReadFile CreateFileA VirtualAlloc

user32

LoadIconA LoadCursorA CreateWindowExA GetSysColor GetWindow SendMessageA ScreenToClient GetWindowRect GetDlgItem RegisterClassA FindWindowA GetLastActivePopup BringWindowToTop AdjustWindowRectEx UpdateWindow ExitWindowsEx IsIconic RedrawWindow PostQuitMessage DefWindowProcA ShowWindow KillTimer SetTimer SendDlgItemMessageA SetFocus DialogBoxIndirectParamA EndDialog EnableWindow MessageBoxA CreateDialogIndirectParamA IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA DestroyWindow RegisterWindowMessageA OemToCharA GetDlgItemTextA PostMessageA SetWindowTextA GetParent GetSystemMetrics SetWindowPos GetDC wsprintfA SetDlgItemTextA ReleaseDC SetWindowLongA GetClientRect BeginPaint FillRect EndPaint

gdi32

SelectObject SetBkMode SetTextColor TextOutA IntersectClipRect SelectPalette CreateDIBPatternBrush StretchDIBits GetDeviceCaps GetSystemPaletteEntries CreatePalette SetBkColor ExtTextOutA GetObjectA CreateFontIndirectA DeleteObject CreateSolidBrush DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC RealizePalette GetStockObject

comdlg32

GetSaveFileNameA

advapi32

RegCloseKey RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueA RegQueryValueExA OpenProcessToken

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA VerFindFileA

comctl32

ord17