WinService[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WinService.exe
Size 1.1MB
Sample260720-w2a7jsbv8k
SHA256 d23bb7987c5b71aa46a7d0f04ca772bea800cb0702cf44dc12d7a5e053900734
MD5 60c9026c2ae0350c0ba85becfa0ff91d
SHA1 dc6b9b006f751fdf855fe3ceb91b78ec770f5d88
SHA512 d9e3c231197842e58269354b7c409452d82de6de8a90fe7dd3efc22eeb226eec80d444893978877489dac93298f0b53855ac0248a5b764746f21f2c3ce7ac7c5
SSDEEP 24576:wsyBPRagzRZVxMGF0cBXVKpsq9AUPEQv:TyBPR1FZVxMGF5BXVKmyV
TLSH
T196354B1BE2B354E8C92BD0748B739772BA30B82945247D2E5EA4EB321F31E505F5E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinService.exe

File Explorer

WinService.exe

.exe 1.1MB

WinService.exe

IMPHASH 1809c666d81defee394347c24f878e70
SHA256 d23bb7987c5b71aa46a7d0f04ca772bea800cb0702cf44dc12d7a5e053900734
MD5 60c9026c2ae0350c0ba85becfa0ff91d
SHA1 dc6b9b006f751fdf855fe3ceb91b78ec770f5d88
SHA512 d9e3c231197842e58269354b7c409452d82de6de8a90fe7dd3efc22eeb226eec80d444893978877489dac93298f0b53855ac0248a5b764746f21f2c3ce7ac7c5
SSDEEP 24576:wsyBPRagzRZVxMGF0cBXVKpsq9AUPEQv:TyBPR1FZVxMGF5BXVKmyV
TLSH
T196354B1BE2B354E8C92BD0748B739772BA30B82945247D2E5EA4EB321F31E505F5E724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle CreateFileA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileA FindNextFileA FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDriveTypeA GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetLastError GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess Process32FirstW Process32NextW RaiseException ReadFile ReadProcessMemory ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetErrorMode SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _ctime64 _errno _fmode _initterm _ismbblead _onexit _time64 abort calloc exit fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset rand realloc setlocale signal srand strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm tolower towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _read

ole32

CoCreateInstance CoInitialize CoUninitialize

shell32

SHGetFolderPathA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

811KB

Virtual Size

811KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WinService.exe

advapi32

kernel32

msvcrt

ole32

shell32

winhttp

generic