MSI4F32[.]tmp | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MSI4F32.tmp
Size 29.1MB
Sample260720-tecqraft9j
SHA256 bdcadab3d2f3e3a32252ce833e54bcd52941da791d299a64f8f3d50dcf65f4a9
MD5 90a11d4ae1399696c8a6db46c756bbe0
SHA1 fb1ec8edddb3d1754e8c83e7f401e03374003925
SHA512 0f81847db84688769f8c29e29bccecc98dee7a1a84bfc8ac8b416b24c379812da852a0197d58393cf7b896e0a65119833398e4433a49cd6b91d475d06567472e
SSDEEP 786432:NuYrEoj7ez3lSuH2iUNzRTDeEh3Arf9L6n7TjdGoo:4Utez3lNtUrqAg47Ed
TLSH
T181673303F7BAA0F4D513C279569AA535FC71B409933876CB23D09B41AF9AF909339B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MSI4F32.tmp

File Explorer

MSI4F32.tmp

.exe 29.1MB

MSI4F32.tmp

IMPHASH 93849df8f2c477394e648db26fa23fe0
SHA256 bdcadab3d2f3e3a32252ce833e54bcd52941da791d299a64f8f3d50dcf65f4a9
MD5 90a11d4ae1399696c8a6db46c756bbe0
SHA1 fb1ec8edddb3d1754e8c83e7f401e03374003925
SHA512 0f81847db84688769f8c29e29bccecc98dee7a1a84bfc8ac8b416b24c379812da852a0197d58393cf7b896e0a65119833398e4433a49cd6b91d475d06567472e
SSDEEP 786432:NuYrEoj7ez3lSuH2iUNzRTDeEh3Arf9L6n7TjdGoo:4Utez3lNtUrqAg47Ed
TLSH
T181673303F7BAA0F4D513C279569AA535FC71B409933876CB23D09B41AF9AF909339B18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

289856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sunshine_dropper_bytes.pdb

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CompareStringW CreateDirectoryW CreateFileW CreateNamedPipeW CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExA FindFirstFileW FindNextFileA FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTickCount64 GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetPerformanceInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadExecutionState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UpdateProcThreadAttribute VirtualQueryEx WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtWriteFile RtlGetVersion RtlNtStatusToDosError

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

bcrypt

BCryptGenRandom

powrprof

CallNtPowerInformation

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

shell32

CommandLineToArgvW ShellExecuteExW

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocStringLen SysFreeString SysStringLen VariantClear

psapi

GetModuleFileNameExW

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

Name

.text

Size

347KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28.7MB

Virtual Size

28.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

161B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MSI4F32.tmp

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

bcrypt

powrprof

ole32

shell32

oleaut32

psapi

pdh

generic