winver_edit[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winver_edit.exe
Size 569KB
Sample260730-31nvkshf26
SHA256 338c92562300957fbb21ed6c3b048d366d17afb62ee14c17cde68d5005604983
MD5 bf46bc146e40788051cc7f6a796fa592
SHA1 8a477923f16dc5dd39344c042792d436d1d266e9
SHA512 4eeae473730005124b2206630b0e58b417e668067e1c827afeaa811c4d4bd3f543bab69b474458469186d05b2d6eeecfad4c9aef91d52bb89eed185da0c04fd4
SSDEEP 12288:6YWoQFwrvBHj4dLT+yMTXS35eKvxyPKQLwRjcAUuLyDQHH:6YWoQFKvBHjOGhaRjpUuLj
TLSH
T131C4191B4FBE451AC1D0ADFA0F307269E4F19980061DC763CF6AAE6C5E3DAD43A858C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winver_edit.exe

File Explorer

winver_edit.exe

.exe 569KB

winver_edit.exe

IMPHASH 372d8057a4007f689a86b72403b582cd
SHA256 338c92562300957fbb21ed6c3b048d366d17afb62ee14c17cde68d5005604983
MD5 bf46bc146e40788051cc7f6a796fa592
SHA1 8a477923f16dc5dd39344c042792d436d1d266e9
SHA512 4eeae473730005124b2206630b0e58b417e668067e1c827afeaa811c4d4bd3f543bab69b474458469186d05b2d6eeecfad4c9aef91d52bb89eed185da0c04fd4
SSDEEP 12288:6YWoQFwrvBHj4dLT+yMTXS35eKvxyPKQLwRjcAUuLyDQHH:6YWoQFKvBHjOGhaRjpUuLj
TLSH
T131C4191B4FBE451AC1D0ADFA0F307269E4F19980061DC763CF6AAE6C5E3DAD43A858C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Winver\Winver\x64\Release\Winver-x64.pdb

kernel32

VirtualProtect CreateFileW MultiByteToWideChar LockResource GlobalAlloc GlobalFree CloseHandle FindResourceExW LoadResource FindResourceW GetProcAddress GlobalLock FreeLibrary LoadLibraryExW SetThreadUILanguage GetUserDefaultUILanguage ReadFile InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId MulDiv QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent LocalFree WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy SizeofResource HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx GetCurrentProcessId HeapFree

user32

EndDialog RegisterClassExW DefWindowProcW GetMessageW GetWindowLongW LoadStringW DestroyWindow FillRect SendMessageW AdjustWindowRectExForDpi GetDpiForWindow SetWindowPos UpdateWindow SetPropW SetFocus CreateWindowExW MessageBoxW EndPaint BeginPaint InvalidateRect DialogBoxParamW PostQuitMessage GetDlgItem GetClientRect SetWindowLongW LoadCursorW LoadIconW ShowWindow DispatchMessageW TranslateMessage TranslateAcceleratorW LoadAcceleratorsW

gdi32

SetBkColor GetStockObject CreateFontW DeleteObject SetBkMode CreateSolidBrush SetTextColor SetDCBrushColor

advapi32

RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegCloseKey

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRect GdipCloneImage GdipSetStringFormatAlign GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFree GdipDrawString GdipCreateFromHDC GdipCloneBrush GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeleteBrush

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

vcruntime140

memset memmove _CxxThrowException __std_exception_copy __std_exception_destroy __std_terminate __CxxFrameHandler3 __C_specific_handler memcpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp wmemcpy_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _register_onexit_function _initialize_onexit_table _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _invalid_parameter_noinfo _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn terminate _set_app_type _errno

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale