decryptor[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
decryptor.exe
Size 267KB
Sample260720-pkpv2sct2x
SHA256 c279341d84c4a346506c8a51fdf501025d959d80f1c3123201a843ea9f66a159
MD5 12e3be1a2476346f42d3396deb921eef
SHA1 2715985b6e6f35a80fb0320d7fc7ebd4a66eb4d9
SHA512 1e0ee023eafd811d17fb890582701547cafb00ef77a8f5658cd5da5a8f82ab11a88591d4343548871cfa8b10d94cfda5a9d8bbc56f62ad5b6fb986006c23a6b8
SSDEEP 3072:rwInP4W35y5f0IriCgK3TErm2Yj0cW5xkAFjnNsshlTXnki2hklOsYqraYCRpb9m:rwoPd5y5fvriW3B2tcYn7hlT91rQb9m
TLSH
T1D444BE5573A510F9E5B78635C9214A42EAB2BC2247B0DF5F03B40765EF237A18D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
decryptor.exe

File Explorer

decryptor.exe

.exe 267KB

decryptor.exe

IMPHASH f412b0a433ad0444e0303c5cc16fe1d1
SHA256 c279341d84c4a346506c8a51fdf501025d959d80f1c3123201a843ea9f66a159
MD5 12e3be1a2476346f42d3396deb921eef
SHA1 2715985b6e6f35a80fb0320d7fc7ebd4a66eb4d9
SHA512 1e0ee023eafd811d17fb890582701547cafb00ef77a8f5658cd5da5a8f82ab11a88591d4343548871cfa8b10d94cfda5a9d8bbc56f62ad5b6fb986006c23a6b8
SSDEEP 3072:rwInP4W35y5f0IriCgK3TErm2Yj0cW5xkAFjnNsshlTXnki2hklOsYqraYCRpb9m:rwoPd5y5fvriW3B2tcYn7hlT91rQb9m
TLSH
T1D444BE5573A510F9E5B78635C9214A42EAB2BC2247B0DF5F03B40765EF237A18D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteA

kernel32

VirtualAlloc GetLocalTime GetComputerNameA GetSystemInfo GlobalMemoryStatusEx GetVersionExA MultiByteToWideChar GetProcessHeap HeapAlloc HeapFree DeleteFileW FindFirstFileW CreateThread FindNextFileW FindClose GetDriveTypeW WaitForMultipleObjects WriteConsoleW CloseHandle SetEndOfFile HeapReAlloc HeapSize CreateFileW FlushFileBuffers GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage WaitForSingleObject GetLastError FindFirstFileExW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptOpenAlgorithmProvider BCryptEncrypt BCryptDestroyKey BCryptGenerateSymmetricKey

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

shlwapi

PathMatchSpecW

iphlpapi

GetAdaptersInfo

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpCloseHandle