patched_app[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
patched_app.exe
Size 11.3MB
Sample260801-3adxpahn5x
SHA256 385ac9fa0e4d13697fa228abe120d3fc6da8619138cc728237398ef505b7991b
MD5 0ce0de19c2c7b197ea83d7a672f36028
SHA1 21ff4629a3bcc394eac5fcb3914eeba7fd5130aa
SHA512 8d0d7c887b85528de4432b307694d5016571f785489691a5a1d7cc4891d14cd0d6e3ad7b0e5faddbb57acd3cee1c2f5ccff6d1c5137ef405d2638d63f84cf257
SSDEEP 98304:T1opKEZ9DoQymz6uHXUwppALdmIXYUiEConbw7KGCGG:T1gfDYmz6u3jAL/XtiECEs7KG
TLSH
T15AC66C1AE2101D95E0A59C39586AB31124F339574DA8BC4AF31E8F0D9F3D23D19BEB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
patched_app.exe

File Explorer

patched_app.exe

.exe 11.3MB

patched_app.exe

IMPHASH cb699bec0c0086b701508eefaeed5541
SHA256 385ac9fa0e4d13697fa228abe120d3fc6da8619138cc728237398ef505b7991b
MD5 0ce0de19c2c7b197ea83d7a672f36028
SHA1 21ff4629a3bcc394eac5fcb3914eeba7fd5130aa
SHA512 8d0d7c887b85528de4432b307694d5016571f785489691a5a1d7cc4891d14cd0d6e3ad7b0e5faddbb57acd3cee1c2f5ccff6d1c5137ef405d2638d63f84cf257
SSDEEP 98304:T1opKEZ9DoQymz6uHXUwppALdmIXYUiEConbw7KGCGG:T1gfDYmz6u3jAL/XtiECEs7KG
TLSH
T15AC66C1AE2101D95E0A59C39586AB31124F339574DA8BC4AF31E8F0D9F3D23D19BEB4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

783628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetQueryOptionA InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA

ws2_32

closesocket inet_pton WSACleanup WSAStartup socket setsockopt send recv htons connect

user32

PeekMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW IsWindow TranslateMessage DestroyWindow LoadCursorA ScreenToClient GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetWindowLongW GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW ShowWindow ClientToScreen MessageBoxW MessageBoxA GetClientRect GetWindowTextW SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow GetAsyncKeyState IsWindowVisible SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes DispatchMessageW

gdi32

CreateSolidBrush

d3dcompiler_47

D3DCompile

comdlg32

GetOpenFileNameW GetSaveFileNameA GetOpenFileNameA

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA RegQueryValueExA

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathW SHGetFolderPathA

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapReAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc VirtualProtect SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage EncodePointer GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile InitializeCriticalSectionAndSpinCount GetModuleHandleA WakeAllConditionVariable GetStdHandle CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile RemoveDirectoryW WriteFile GetTempPathW GetVolumeInformationA CloseHandle SetUnhandledExceptionFilter GetLastError WaitForSingleObject ExitProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread OpenProcess GetLocalTime GetTickCount GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx RtlUnwind GetModuleHandleW GetProcAddress WinExec WideCharToMultiByte FreeConsole GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep GetCurrentThreadId ReadProcessMemory Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA OutputDebugStringA WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.8MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

patched_app.exe

wininet

ws2_32

user32

gdi32

d3dcompiler_47

comdlg32

iphlpapi

advapi32

dwmapi

shell32

d3d11

kernel32

imm32

generic