doktrk2k[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
doktrk2k.zip
Size 332KB
Sample260801-g2zskseq91
SHA256 c197f8b28f93e131fbd4a0cf94076b5699c4b99cba8bb62b2e46138f759d6fbd
MD5 c41e63d4835e55ec17115e072376a1cb
SHA1 3130f3afc5baa11e9cd602a1847727eedeea5a2d
SHA512 6b7e10c129f15de53f3ed5cd48723447a5e82621f58c2db97ae65e900d34ce41a3aa22845730a30a18e0bfc7dd2fd5d6f4e4217d98d001bd7c98e856a8d04c81
SSDEEP 6144:blPF3ud4MCZuYQnFfhd4OE0e6GxeFx9dZWGJXTyhfxw7/opjODxuA:5dkmuYsFJGOVXnL8GJyb+wYJ
TLSH
T1BD7423D64838E87BFDCF0150A118F54837A9DDD9B1A9EEF54B1B634AAC8864C3BD4098
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DocTrak2000_Setup.exe

File Explorer

doktrk2k.zip

.zip 332KB
DocTrak2000_Setup.exe

.exe 565KB

doktrk2k.zip

SHA256 c197f8b28f93e131fbd4a0cf94076b5699c4b99cba8bb62b2e46138f759d6fbd
MD5 c41e63d4835e55ec17115e072376a1cb
SHA1 3130f3afc5baa11e9cd602a1847727eedeea5a2d
SHA512 6b7e10c129f15de53f3ed5cd48723447a5e82621f58c2db97ae65e900d34ce41a3aa22845730a30a18e0bfc7dd2fd5d6f4e4217d98d001bd7c98e856a8d04c81
SSDEEP 6144:blPF3ud4MCZuYQnFfhd4OE0e6GxeFx9dZWGJXTyhfxw7/opjODxuA:5dkmuYsFJGOVXnL8GJyb+wYJ
TLSH
T1BD7423D64838E87BFDCF0150A118F54837A9DDD9B1A9EEF54B1B634AAC8864C3BD4098
MD5 SHA1 SHA512 SSDEEP TLSH

DocTrak2000_Setup.exe

IMPHASH ed4817bd12c7cb91fdcfb0ad265f5af2
SHA256 71049b3b87bd020ff9b0b2350934eb2033788cee76b58f6138cdb695df1636e1
MD5 1b8808c9b69a6728668265f05871fc3d
SHA1 dc6bf663edac5b14f36fe4f9ad780001fa05b8e2
SHA512 f58bb9058f88fb0259e333de76d9ba770e5c70026b76ae696770e9677d725c8bc64ba3f55f3bfd512f1de3a413539e8f9bdfea7f162a1745d37507ff68fa3880
SSDEEP 12288:AE3uoLIfD8tmxqbzbRqOqYyQ6HnEp1iAnQMKRA5+wlC9xJ8RX:AEeJfDRxmbRBqYy3nEprQ/Rw8x0
TLSH
T1FCC4D01A72918273C5430231496BAB719F75FC384B72081377997B8E2DB3AE4E3A71D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA VerLanguageNameA

shell32

SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA

comctl32

ord17

kernel32

QueryPerformanceFrequency CreateEventA Sleep InterlockedDecrement MoveFileA lstrcatA CompareStringA CompareStringW GetVersionExA SetFilePointer SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FreeLibrary GetProcAddress LoadLibraryA MapViewOfFile UnmapViewOfFile CreateFileMappingA LockResource WriteFile SizeofResource FindResourceA CreateProcessA GetModuleFileNameA GetTickCount GetSystemDefaultLCID GlobalHandle SetLastError lstrlenW InterlockedIncrement GetPrivateProfileSectionA WaitForSingleObject GetSystemInfo IsValidCodePage FlushFileBuffers LocalFree FormatMessageA GetDiskFreeSpaceA _lclose OpenFile GetDriveTypeA CreateDirectoryA GetFileAttributesA RemoveDirectoryA GetExitCodeProcess GetCurrentProcess GetCurrentThread GetLocaleInfoA GetPrivateProfileStringA lstrlenA CreateFileA GetFileSize GlobalAlloc CloseHandle GlobalLock ReadFile GlobalUnlock GlobalFree WideCharToMultiByte DeleteFileA GetLastError CreateThread CopyFileA MultiByteToWideChar ExpandEnvironmentStringsA GetExitCodeThread lstrcmpiA SetErrorMode GetPrivateProfileIntA GetTempPathA WritePrivateProfileStringA GetWindowsDirectoryA GetTempFileNameA lstrcmpA lstrcpyA SetCurrentDirectoryA LoadResource GetStdHandle RaiseException GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetOEMCP SetHandleCount GetACP GetCPInfo SetUnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSection IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId HeapSize HeapReAlloc LeaveCriticalSection EnterCriticalSection GetVersion GetCommandLineA GetStartupInfoA GetModuleHandleA TerminateProcess ExitProcess SetStdHandle HeapAlloc HeapFree RtlUnwind SystemTimeToFileTime QueryPerformanceCounter ResetEvent SetEvent lstrcpynA SearchPathA FindFirstFileA VirtualProtect VirtualQuery FindClose IsBadReadPtr GetStringTypeA GetStringTypeW LCMapStringW LCMapStringA IsBadCodePtr GetFileType

user32

MessageBoxA ReleaseDC GetDC DispatchMessageA TranslateMessage GetMessageA CreateWindowExA RegisterClassA LoadCursorA LoadIconA SetTimer PostQuitMessage KillTimer PostMessageA DefWindowProcA PeekMessageA MsgWaitForMultipleObjects wsprintfA GetDesktopWindow DialogBoxParamA ShowWindow GetDlgItem EndDialog GetWindowDC SetWindowPos ClientToScreen GetClientRect SetWindowLongA EndPaint BeginPaint GetWindowLongA WaitForInputIdle CharNextA SendDlgItemMessageA ExitWindowsEx CharPrevA LoadStringA wvsprintfA GetClassInfoA UpdateWindow SetCursor GetDlgItemTextA EnableWindow GetParent GetWindowTextLengthA GetWindowTextA MoveWindow GetWindowPlacement DrawIcon GetDlgCtrlID SetWindowTextA FillRect GetSysColor GetSysColorBrush IsDialogMessageA SendMessageA GetWindowRect GetSystemMetrics FindWindowA IntersectRect SubtractRect IsWindow DestroyWindow CreateDialogParamA SetRect DestroyIcon CharLowerBuffA

gdi32

CreateDIBitmap GetDeviceCaps CreatePalette SelectPalette GetStockObject DeleteObject GetSystemPaletteEntries BitBlt SelectObject DeleteDC CreateSolidBrush CreateFontIndirectA CreateCompatibleDC SetTextColor SetBkMode GetObjectA TranslateCharsetInfo GetTextExtentPointA RealizePalette

advapi32

FreeSid RegQueryValueA RegOpenKeyA RegCloseKey RegQueryValueExA OpenThreadToken GetTokenInformation AllocateAndInitializeSid OpenProcessToken EqualSid RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegEnumValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA

ole32

CreateItemMoniker CoCreateGuid StringFromCLSID StgIsStorageFile StgOpenStorage CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize GetRunningObjectTable

oleaut32

SysReAllocStringLen SysFreeString SysAllocString SysAllocStringLen SysStringLen VariantClear VariantChangeType