Döner[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Döner.exe
Size 11.6MB
Sample260801-2qdfesaa62
SHA256 ac9f0b87f15ed47fa88c584cb8b8bee45a56965ad2199355b7c30c427fa7be4c
MD5 c5647ce63d84ceafb09e02012b431fb5
SHA1 cb50283a68945a3eadbc664f4de79f732adf1d27
SHA512 140dd364393a4d2e381e9801ed658fc28f38067bbf39ee217ab97cd1c5221f7963fdbc5f2c3920a5dd5229433bb7fca19df19a330f0928ef4cb649c6b8fba152
SSDEEP 196608:b00UXTv4UW/RCjr9kONWnwTjuU5TP3g+:b6XTvLwCjJ1bTjuU/
TLSH
T196C6CE71969C8B4DF06AB038C5875617A7F1BC0C5721CFCB9AD09CB70E2F690F66A609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Döner.exe

File Explorer

Döner.exe

.exe 11.6MB

Döner.exe

IMPHASH d6a2b886cf7dc44a47d7bc1e16bca544
SHA256 ac9f0b87f15ed47fa88c584cb8b8bee45a56965ad2199355b7c30c427fa7be4c
MD5 c5647ce63d84ceafb09e02012b431fb5
SHA1 cb50283a68945a3eadbc664f4de79f732adf1d27
SHA512 140dd364393a4d2e381e9801ed658fc28f38067bbf39ee217ab97cd1c5221f7963fdbc5f2c3920a5dd5229433bb7fca19df19a330f0928ef4cb649c6b8fba152
SSDEEP 196608:b00UXTv4UW/RCjr9kONWnwTjuU5TP3g+:b6XTvLwCjJ1bTjuU/
TLSH
T196C6CE71969C8B4DF06AB038C5875617A7F1BC0C5721CFCB9AD09CB70E2F690F66A609
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8808100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA InternetOpenUrlA HttpOpenRequestA HttpQueryInfoA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

kernel32

SizeofResource MoveFileA GetFileAttributesExA FindFirstFileA SetWaitableTimer GetConsoleScreenBufferInfo CreateNamedPipeA SetConsoleTitleA GetCurrentProcess GetStdHandle CreateWaitableTimerW WriteFile OutputDebugStringA TerminateProcess GetModuleFileNameW GetProcessId FindNextFileA SetThreadPriority ExpandEnvironmentStringsA GetEnvironmentVariableA FindClose CreateMutexA GetVolumeInformationA WaitForSingleObject GetModuleHandleA DisconnectNamedPipe RtlCaptureStackBackTrace OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetModuleHandleExA GetTickCount64 GetLastError AttachConsole GetFileAttributesA Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread LoadLibraryA LockResource DeleteFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle WritePrivateProfileStringA CreateThread GetWindowsDirectoryA LoadResource FindResourceW Module32FirstW GetLocalTime FillConsoleOutputAttribute GetThreadContext GetProcAddress GlobalLock ReadProcessMemory GetCurrentProcessId GetModuleHandleW FreeLibrary WideCharToMultiByte GetConsoleWindow Module32NextW CreateProcessA SetConsoleOutputCP CreateDirectoryA CreateWaitableTimerExW GetTempFileNameA SetConsoleCursorPosition GetPrivateProfileIntA GetPrivateProfileStringA GetTickCount GlobalUnlock AllocConsole IsDebuggerPresent ConnectNamedPipe CheckRemoteDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess MultiByteToWideChar GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter CompareFileTime CopyFileA FillConsoleOutputCharacterA CreateProcessW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection GetModuleFileNameA ReadFile HeapReAlloc IsValidCodePage GetACP RtlUnwind GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection SetEnvironmentVariableW SetStdHandle GetSystemTimeAsFileTime InitializeCriticalSectionEx GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx GetProcessHeap HeapSize WriteConsoleW SetEndOfFile ExitProcess RtlPcToFileHeader RaiseException LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW

user32

TranslateMessage BringWindowToTop SetFocus SetClipboardData SendInput GetCursorPos SetForegroundWindow SetWindowLongW EnumWindows GetForegroundWindow MessageBoxA SetWindowDisplayAffinity GetWindowTextA PeekMessageW EmptyClipboard CloseClipboard ReleaseCapture UpdateWindow FindWindowW GetClientRect PostQuitMessage SetLayeredWindowAttributes SetWindowPos DispatchMessageW GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode SetCursorPos GetClipboardData GetWindowThreadProcessId DefWindowProcW MapVirtualKeyW DestroyWindow OpenClipboard keybd_event MonitorFromWindow SetActiveWindow CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState FindWindowA

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA ShellExecuteExA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

shlwapi

PathRemoveFileSpecA

winmm

timeBeginPeriod PlaySoundA

dbghelp

SymSetOptions SymInitialize SymFromAddr

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Döner.exe

wininet

ole32

kernel32

user32

comdlg32

advapi32

shell32

d3d11

d3dcompiler_47

winhttp

dwmapi

shlwapi

winmm

dbghelp

imm32

generic