14[.]60[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
14.60.exe
Size 339KB
Sample260720-x125baev4t
SHA256 a4658f8a9e8c09f00e4b2e1e55b85076378cf9b831f28999c22db5bbd61f9797
MD5 e3c2468a61fe4488d9c5053c83749280
SHA1 2b15536305feed198c7ae330238af05658b25bbe
SHA512 26a8445de1102f1279636755435d39267d50d41c05d3c2f308d13480112726fd073666e5e76234a58c0165ccfdfd94f8b6792b004866506b4a3eaa72944c75b8
SSDEEP 6144:yLe0uWcBqOyDUs6wIlYeSKLr3CdB0BknQzE+:jPWyK+knQJ
TLSH
T197747D4AF2A450E9D067903895ABB20FF975386C031047DB33F895953FD36E0BEBA652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14.60.exe

File Explorer

14.60.exe

.exe 339KB

14.60.exe

IMPHASH 73b5094f02c02ec8cee8ce284ef277ff
SHA256 a4658f8a9e8c09f00e4b2e1e55b85076378cf9b831f28999c22db5bbd61f9797
MD5 e3c2468a61fe4488d9c5053c83749280
SHA1 2b15536305feed198c7ae330238af05658b25bbe
SHA512 26a8445de1102f1279636755435d39267d50d41c05d3c2f308d13480112726fd073666e5e76234a58c0165ccfdfd94f8b6792b004866506b4a3eaa72944c75b8
SSDEEP 6144:yLe0uWcBqOyDUs6wIlYeSKLr3CdB0BknQzE+:jPWyK+knQJ
TLSH
T197747D4AF2A450E9D067903895ABB20FF975386C031047DB33F895953FD36E0BEBA652
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

271256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\tuksa\source\repos\14.60\14.60\bin\x64\Release\14.60.pdb

kernel32

WideCharToMultiByte GlobalUnlock GetModuleHandleA GetProcAddress QueryPerformanceFrequency QueryPerformanceCounter SetLastError GetCurrentProcess Module32Next Module32First GetLastError VirtualProtectEx GetCurrentProcessId VirtualQueryEx GetModuleHandleW IsDebuggerPresent GlobalFree GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId Sleep GlobalLock GlobalAlloc WriteProcessMemory MultiByteToWideChar Module32NextW ReadProcessMemory Module32FirstW CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess InitializeSListHead

user32

TranslateMessage EnumWindows SetWindowDisplayAffinity SetWindowLongA ShowWindow PeekMessageA GetWindowThreadProcessId DispatchMessageA GetWindowRect SetWindowPos DestroyWindow GetActiveWindow UpdateWindow GetAsyncKeyState GetKeyState LoadCursorA SetCursorPos ScreenToClient ClientToScreen GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData FindWindowA SetCursor GetForegroundWindow GetClientRect

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

_Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Xbad_alloc@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_do_broadcast_at_thread_exit

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset _CxxThrowException __C_specific_handler memmove memcpy memcmp __std_terminate memchr __current_exception_context __current_exception __std_exception_copy strstr __std_exception_destroy

api-ms-win-crt-string-l1-1-0

strncmp strcmp _wcsicmp strncpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode ftell fflush _set_fmode fclose __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek __stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit exit system terminate _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _beginthreadex _cexit __p___argv __p___argc _set_app_type _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _invoke_watson

api-ms-win-crt-math-l1-1-0

__setusermatherr cos cosf fmodf acosf pow powf sin sinf ceilf sqrtf logf tanf sqrt

api-ms-win-crt-locale-l1-1-0

_configthreadlocale