CatUD[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CatUD.zip
Size 828KB
Sample260730-fty1mstvg1
SHA256 e4658ce470c8cc710da29b7e7c703cdbb20c924507a1a1ac07e83d750e671750
MD5 c1baca19ca4f2179869e581ea6015bf9
SHA1 595d14e657f521b65ea265250d824646af1b75d7
SHA512 c636a155bfb935e3c2cebd39e39e3c511b8256cb642b4f69b2544febc33ba5e0819fe18ade9fcaae1f40aa109166c2e54524d28015a2ecaff356a7966f79f260
SSDEEP 24576:HZFnX3g+byvXIAioGYndCHfYHNp9JGBfP:Hrn1byvXBiv2p9UB3
TLSH
T1790533A4586DFA6894AFB6A1C991F28FAAD3F7C2CE713A738535D40029C3414175CF93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CatUD.exe

File Explorer

CatUD.zip

.zip 828KB
CatUD.exe

.exe 1.6MB

CatUD.zip

SHA256 e4658ce470c8cc710da29b7e7c703cdbb20c924507a1a1ac07e83d750e671750
MD5 c1baca19ca4f2179869e581ea6015bf9
SHA1 595d14e657f521b65ea265250d824646af1b75d7
SHA512 c636a155bfb935e3c2cebd39e39e3c511b8256cb642b4f69b2544febc33ba5e0819fe18ade9fcaae1f40aa109166c2e54524d28015a2ecaff356a7966f79f260
SSDEEP 24576:HZFnX3g+byvXIAioGYndCHfYHNp9JGBfP:Hrn1byvXBiv2p9UB3
TLSH
T1790533A4586DFA6894AFB6A1C991F28FAAD3F7C2CE713A738535D40029C3414175CF93
MD5 SHA1 SHA512 SSDEEP TLSH

CatUD.exe

IMPHASH da8d375b7b1e776cb44fadcc3d60f96f
SHA256 b3dc85a76b38ff78cba029af8c2f28daecdf93776be7ddf6a536453277a5887d
MD5 d26d5fe9ff1183c13695320323c6ff1d
SHA1 4824ec72a0158dfae35765e04f188bfd6c7f978c
SHA512 87a636132418d9859caee66a6951232bf8a85203930a8934149fe30ffe0758691173974f33ecc51799490f0a5809eb168364ea28c38bf58e081e07d934bd31b7
SSDEEP 24576:QS8Sf31DhwJAReA4WsDwWPqGIgmfHTv98jjZOivnbeLOk1nqMJbUs+:QaMgeA6x9mbv9ovnKLOkNNtUs+
TLSH
T1F775BF42B2B681ECD16AD078C246A71BE732380907205BDB77D03F596FB7AE05B7A315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

919040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mcleu\Downloads\Fang_Source_Fixed\Build\Fang.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ

gdi32

GetDeviceCaps

dwmapi

DwmExtendFrameIntoClientArea

user32

UpdateWindow GetAsyncKeyState FindWindowA SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC PeekMessageA ScreenToClient PostQuitMessage ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos TranslateMessage SetLayeredWindowAttributes RegisterClassExA GetCapture CreateWindowExA UnregisterClassA DefWindowProcA MessageBoxA SetWindowDisplayAffinity SetWindowLongA MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow GetSystemMetrics ShowWindow

kernel32

GetCurrentProcessId GetSystemTimeAsFileTime WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA SetConsoleTitleA GetExitCodeProcess VirtualAllocEx CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First GetProcessId Module32Next Process32First GetCurrentThread SetThreadPriority Sleep GetConsoleMode SetConsoleMode GetStdHandle GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp _CxxThrowException __current_exception_context __current_exception __C_specific_handler memcmp memchr __std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

nearbyint fmodf sqrtf logf pow sinf roundf log acosf powf cosf ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func fflush fclose fseek _set_fmode __stdio_common_vfprintf fwrite __stdio_common_vsscanf fread ftell _wfopen __p__commode

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

tolower _stricmp strncpy strlen strcmp strncmp

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex __p___argv _exit _c_exit exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _get_initial_narrow_environment _set_app_type __p___argc _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe system

api-ms-win-crt-locale-l1-1-0

_configthreadlocale