PaintPilot [Meccha Chameleon][.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PaintPilot [Meccha Chameleon].exe
Size 11.0MB
Sample260730-crvcws1te1
SHA256 155529665c70c44f2b9f28d3b9328295a7af7b42a13e16ce71449863c0ee251c
MD5 0d3c57269424436bb6b711c6027efae1
SHA1 b0e5a88a18ff342b9804b308833506df172b6ad5
SHA512 11dacea4fd3d7931418bb494800b4270f401072e2ce85d2d6ea4551247db5706073e78807c4f91b12aba1b2f75bd6404f870b4697b7b010e184fa5b472ad4e3c
SSDEEP 98304:m1qjsuAfN84qszUwppALdmIXYUiEConbw7K0B:m1h1qszjAL/XtiECEs7K0
TLSH
T1EDC66C1AE2102D95E0959C39586AB31128F339578DA8BC06F31D8F0D9F3D27D1A7EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PaintPilot [Meccha Chameleon].exe

File Explorer

PaintPilot [Meccha Chameleon].exe

.exe 11.0MB

PaintPilot [Meccha Chameleon].exe

IMPHASH ced6fcecba7b01a81252b9bba45428af
SHA256 155529665c70c44f2b9f28d3b9328295a7af7b42a13e16ce71449863c0ee251c
MD5 0d3c57269424436bb6b711c6027efae1
SHA1 b0e5a88a18ff342b9804b308833506df172b6ad5
SHA512 11dacea4fd3d7931418bb494800b4270f401072e2ce85d2d6ea4551247db5706073e78807c4f91b12aba1b2f75bd6404f870b4697b7b010e184fa5b472ad4e3c
SSDEEP 98304:m1qjsuAfN84qszUwppALdmIXYUiEConbw7K0B:m1h1qszjAL/XtiECEs7K0
TLSH
T1EDC66C1AE2102D95E0959C39586AB31128F339578DA8BC06F31D8F0D9F3D27D1A7EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

720884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetQueryOptionA InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA

ws2_32

closesocket inet_pton WSACleanup WSAStartup socket setsockopt send recv htons connect

user32

PeekMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW IsWindow TranslateMessage DestroyWindow LoadCursorA ScreenToClient GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetWindowLongW GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW ShowWindow ClientToScreen MessageBoxW MessageBoxA GetClientRect GetWindowTextW SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow GetAsyncKeyState IsWindowVisible SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes DispatchMessageW

gdi32

CreateSolidBrush

d3dcompiler_47

D3DCompile

comdlg32

GetOpenFileNameW GetSaveFileNameA GetOpenFileNameA

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA RegQueryValueExA

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathW SHGetFolderPathA

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapReAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetFileType FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount VirtualProtect RtlUnwindEx RaiseException RtlPcToFileHeader GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage WakeAllConditionVariable GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile SetLastError GetModuleFileNameW GetStdHandle CreateDirectoryA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile RemoveDirectoryW WriteFile GetTempPathW GetVolumeInformationA CloseHandle SetUnhandledExceptionFilter GetLastError WaitForSingleObject ExitProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread OpenProcess GetLocalTime GetTickCount GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx RtlUnwind GetModuleHandleA GetModuleHandleW GetProcAddress WinExec WideCharToMultiByte FreeConsole GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep ReadProcessMemory Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA OutputDebugStringA WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

952KB

Virtual Size

951KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.7MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PaintPilot [Meccha Chameleon].exe

wininet

ws2_32

user32

gdi32

d3dcompiler_47

comdlg32

iphlpapi

advapi32

dwmapi

shell32

d3d11

kernel32

imm32

generic