SharkHack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SharkHack.exe
Size 14.9MB
Sample260727-tr2weaxtfx
SHA256 9364cb56fbf209e835012427d8e250983a471db1baf05fb223683523c667ed18
MD5 519d1e819fca2183a4c24f8ba53280e9
SHA1 ce3414224b525f2de63c574beb97c4d23cc13afc
SHA512 cdbed405a0f646969eb6a6f6b63d69f1a1c7d02f8cd820302391f6ca6834c38e0b883d748f411c7e7d97cc6548f06f5ddf818faeecde13f5b28f9068a6b8340c
SSDEEP 24576:OGyjYRxUb/5FL9r1/QOArQ/q9e4tl9o/lgI3zOxsmhWBkRNJd:OGykxUT9raOA8C9Rl9o/l7Omqrd
TLSH
T117F68D023BFEB05AE99BC7B8A47523415A24FC770861945931DD709A4FBB9403FBC2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SharkHack.exe

File Explorer

SharkHack.exe

.exe 14.9MB

SharkHack.exe

IMPHASH e81bbd862523153b9305669f326aae22
SHA256 9364cb56fbf209e835012427d8e250983a471db1baf05fb223683523c667ed18
MD5 519d1e819fca2183a4c24f8ba53280e9
SHA1 ce3414224b525f2de63c574beb97c4d23cc13afc
SHA512 cdbed405a0f646969eb6a6f6b63d69f1a1c7d02f8cd820302391f6ca6834c38e0b883d748f411c7e7d97cc6548f06f5ddf818faeecde13f5b28f9068a6b8340c
SSDEEP 24576:OGyjYRxUb/5FL9r1/QOArQ/q9e4tl9o/lgI3zOxsmhWBkRNJd:OGykxUT9raOA8C9Rl9o/l7Omqrd
TLSH
T117F68D023BFEB05AE99BC7B8A47523415A24FC770861945931DD709A4FBB9403FBC2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DuplicateHandle ExitProcess GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteConsoleW

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

ntdll

NtWriteFile RtlNtStatusToDosError

advapi32

GetTokenInformation OpenProcessToken

user32

GetDesktopWindow GetSystemMetrics

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SharkHack.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

advapi32

user32

api-ms-win-core-synch-l1-2-0

generic