retrac-f8df2c75[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
retrac-f8df2c75.exe
Size 501KB
Sample260730-2sl6ca11es
SHA256 b473c3e7fe0736531be831543e89e4c20831325399bd3b4868ae8f7e06858b9a
MD5 412c3f19f9558ea8f2ff02b1e0e083b0
SHA1 82ca33192eafc000c88705abbb44adaf3d7f3345
SHA512 89638d51eb8eaad8526fcbbfb3afa7f0830e8cb386df4a2187872294a221293a8acd0a6002d7aa85d49116acbfaf21cbb681abfb60454cb1f44b0681383c5bff
SSDEEP 12288:AkH0PjawCBjGn5MN1xKZrBs61WEYiEnmq:AkHOahS5MXgZrX1WDiEnmq
TLSH
T17DB4BF46F2BEA7F5C06BD034E546BA0BFE313858075059DB63E409A527E37E09BB7242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
retrac-f8df2c75.exe

File Explorer

retrac-f8df2c75.exe

.exe 501KB

retrac-f8df2c75.exe

IMPHASH 29dca07cad4192616fb4835bdd263947
SHA256 b473c3e7fe0736531be831543e89e4c20831325399bd3b4868ae8f7e06858b9a
MD5 412c3f19f9558ea8f2ff02b1e0e083b0
SHA1 82ca33192eafc000c88705abbb44adaf3d7f3345
SHA512 89638d51eb8eaad8526fcbbfb3afa7f0830e8cb386df4a2187872294a221293a8acd0a6002d7aa85d49116acbfaf21cbb681abfb60454cb1f44b0681383c5bff
SSDEEP 12288:AkH0PjawCBjGn5MN1xKZrBs61WEYiEnmq:AkHOahS5MXgZrX1WDiEnmq
TLSH
T17DB4BF46F2BEA7F5C06BD034E546BA0BFE313858075059DB63E409A527E37E09BB7242
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

402276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime OutputDebugStringA GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualQueryEx GetModuleHandleW MultiByteToWideChar ReadProcessMemory WriteProcessMemory CloseHandle Process32FirstW Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess GetCurrentThreadId

user32

SetCursorPos ReleaseCapture IsWindowUnicode SetWindowPos GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetWindowLongPtrW CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage mouse_event GetClientRect PostQuitMessage GetCursorPos SetCursor

gdi32

CreateSolidBrush

shell32

ShellExecuteW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Mtx_unlock _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate memmove __C_specific_handler memset memcpy memchr memcmp

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit _invoke_watson __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _beginthreadex system terminate _crt_atexit _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

strncmp _wcsicmp strncpy strcmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode ftell __stdio_common_vsprintf_s __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __acrt_iob_func fflush __stdio_common_vfprintf fseek fclose __p__commode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

sqrtf logf fmodf sinf powf cosf ceilf acosf tanf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale