sysinfo[.]exe | Triage™

General

Target
sysinfo.exe
Size 363KB
Sample260724-h224datxc1
SHA256 36be6cc61d40c6cee7ecb525c94919289c09551cdb334531d17fb6290eec5999
MD5 1b87abd540f47a36093add5b8d857ef9
SHA1 3ce1a404aedc649e589f7c91fdefcb66483472a2
SHA512 750becaaa236342ba590b659df9173ffa215d962c4d03114cf32c9a42572308eae6fdff0faef7376547f2f7da1150378bbdc2d9d6ff6247440664aa6a5e13311
SSDEEP 3072:H9h0FruKLWjMm1KvycgfGaq+BFN5c3cczPs0pABRUejkcVTeuWjvtl96XlEfFHdw:qucE11yPs0pAgXeZM1l/yB4e5cCK4Q
TLSH
T1B984390AFAA514F5D0BBD038C552651AFDB17CAA4370ABCB67944A571F23BE0AD3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sysinfo.exe

File Explorer

sysinfo.exe

.exe 363KB

sysinfo.exe

IMPHASH 10a1331ed7d67b2407ab0ec8e0ea3afa
SHA256 36be6cc61d40c6cee7ecb525c94919289c09551cdb334531d17fb6290eec5999
MD5 1b87abd540f47a36093add5b8d857ef9
SHA1 3ce1a404aedc649e589f7c91fdefcb66483472a2
SHA512 750becaaa236342ba590b659df9173ffa215d962c4d03114cf32c9a42572308eae6fdff0faef7376547f2f7da1150378bbdc2d9d6ff6247440664aa6a5e13311
SSDEEP 3072:H9h0FruKLWjMm1KvycgfGaq+BFN5c3cczPs0pABRUejkcVTeuWjvtl96XlEfFHdw:qucE11yPs0pAgXeZM1l/yB4e5cCK4Q
TLSH
T1B984390AFAA514F5D0BBD038C552651AFDB17CAA4370ABCB67944A571F23BE0AD3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

107420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

advapi32

CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA GetUserNameA CryptDestroyHash

kernel32

FreeEnvironmentStringsW GetOEMCP SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile GetEnvironmentStringsW RtlVirtualUnwind GetEnvironmentVariableA CreateFileA GetDiskFreeSpaceExA ReadFile CloseHandle GetSystemPowerStatus WideCharToMultiByte GetACP IsValidCodePage HeapReAlloc LocalFree GetLastError FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW

Name

.text

Size

252KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

sysinfo.exe

ole32

oleaut32

advapi32

kernel32

generic