gui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gui.exe
Size 1.6MB
Sample260722-nph3maec42
SHA256 e7eaba5487c734df97b23f59d7434483c2dfaf5d65d2956b5d17c598b5ee4c69
MD5 7fa47bfdcbc0f5db006131fabb9888ea
SHA1 9d7c8e4bec657b888cac1bb56685d80c6c2efc52
SHA512 a16e2df8846cc4e5e006b9798022ec90b0656cea48a727a79494fe333048a6d68b3a4060fd5024f2662cbb094c1db5c44cf6790cdb4f6410c57d4456b02938ee
SSDEEP 49152:sOyaK1hRXdnxZiyN+YQ0iTAnNwEj9tpUQIPLw1MrD/3hJL8S8eYKO8bFa21+C5V6:sOydRXNxZiyN+YQ0iTAnNwEj9tpUQIPr
TLSH
T1CA75B042E2A406F8C65FD1388656A72FE771341903209BDB67D44AAA3F53EE05F3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gui.exe

File Explorer

gui.exe

.exe 1.6MB

gui.exe

IMPHASH 740bc87454e809447e78bfd6bbe222f3
SHA256 e7eaba5487c734df97b23f59d7434483c2dfaf5d65d2956b5d17c598b5ee4c69
MD5 7fa47bfdcbc0f5db006131fabb9888ea
SHA1 9d7c8e4bec657b888cac1bb56685d80c6c2efc52
SHA512 a16e2df8846cc4e5e006b9798022ec90b0656cea48a727a79494fe333048a6d68b3a4060fd5024f2662cbb094c1db5c44cf6790cdb4f6410c57d4456b02938ee
SSDEEP 49152:sOyaK1hRXdnxZiyN+YQ0iTAnNwEj9tpUQIPLw1MrD/3hJL8S8eYKO8bFa21+C5V6:sOydRXNxZiyN+YQ0iTAnNwEj9tpUQIPr
TLSH
T1CA75B042E2A406F8C65FD1388656A72FE771341903209BDB67D44AAA3F53EE05F3E361
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1058976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LCMapStringA GetStringTypeExA GetUserDefaultLCID CreateFileA GetFileSizeEx ReadFile FreeLibrary HeapAlloc LoadLibraryA HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter GetProcAddress CloseHandle QueryPerformanceFrequency GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetLocaleInfoA ReleaseSRWLockExclusive InitializeSListHead

user32

PostQuitMessage PeekMessageA TranslateMessage DefWindowProcA MessageBoxA LoadStringA DispatchMessageA GetCursorPos CreateWindowExA UnregisterClassA UpdateWindow OpenClipboard RegisterClassA GetSystemMetrics CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA ShowWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos DestroyWindow

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __std_type_info_compare _purecall strrchr longjmp memcpy memmove __std_terminate __std_exception_destroy memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memchr memset __std_exception_copy

api-ms-win-crt-string-l1-1-0

toupper strlen strncpy strncmp isblank isspace strcpy strcpy_s strcmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vfprintf fseek __p__commode fflush fwrite _wfopen ftell __stdio_common_vsprintf fread __stdio_common_vsscanf __acrt_iob_func fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-convert-l1-1-0

strtol atof

api-ms-win-crt-runtime-l1-1-0

exit _register_thread_local_exe_atexit_callback _c_exit _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _initterm_e _get_narrow_winmain_command_line _initterm abort

api-ms-win-crt-math-l1-1-0

floorf sqrtf cosf powf acosf atan2f logf sinf __setusermatherr fmodf ceilf pow floor

api-ms-win-crt-locale-l1-1-0

_configthreadlocale