Petya[.]A[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Petya.A.exe
Size 225KB
Sample260727-rb7evabd26
SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
MD5 af2379cc4d607a45ac44d62135fb7015
SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
TLSH
T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Petya.A.exe

File Explorer

Petya.A.exe

.exe 225KB

Petya.A.exe

IMPHASH 1a63922d5931d1bb8ca5188313f78eaa
SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
MD5 af2379cc4d607a45ac44d62135fb7015
SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
TLSH
T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleCrashHandler_unsigned.pdb

kernel32

GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CreateSemaphoreW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalFree CreateDirectoryW DeleteFileW GetCurrentThread WaitForMultipleObjects LoadLibraryW WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime OutputDebugStringA GetPrivateProfileIntW GetPrivateProfileStringW lstrcmpW lstrlenW SetFilePointer CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW SetLastError VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree CreateThread DebugActiveProcess GetThreadContext DebugActiveProcessStop VirtualQueryEx GetProcessId GetSystemInfo ContinueDebugEvent WaitForDebugEvent WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess IsProcessorFeaturePresent GetCommandLineW EncodePointer LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState RtlCaptureContext ReleaseSemaphore EnterCriticalSection OutputDebugStringW DeleteCriticalSection DecodePointer HeapSize GetProcAddress GetLastError RaiseException HeapDestroy InitializeCriticalSectionAndSpinCount GetProcessHeap GetModuleHandleW HeapFree IsDebuggerPresent GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc HeapAlloc RemoveDirectoryW HeapReAlloc

user32

SetClipboardData EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW CharLowerW PostThreadMessageW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId SetThreadDesktop CreateWindowStationW CloseWindowStation GetThreadDesktop SetProcessWindowStation CreateDesktopW wvsprintfW wsprintfW MessageBoxW

advapi32

GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetWkstaGetInfo

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW