Döner[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Döner.exe
Size 11.6MB
Sample260802-1mlryssele
SHA256 b9baaf9822686896bad2c7d8a557acbb1fe98b008ea73f9479a9de11134b8065
MD5 e426fdf0a00ce121d4127b8e47b46463
SHA1 485e6b110fbc87b73755f53759fe57a779432430
SHA512 b00452fab346bf1e362d2116be2ad4c916b04f69e7019d56d45b488833dfea9bc1f34bc506b820e757d65cc4db541cb295de6e82225988d360103803cb5465c0
SSDEEP 196608:o00UXTv+UW/RCjBrb8Mz5NWnwTjuU5TPEg+:o6XTvRwCjhwaPbTjuUM
TLSH
T10CC6CE61869C8B4DF06AF038C5876217A7F1BC0C5721DFCB9AD09CB70E2F690F56A619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Döner.exe

File Explorer

Döner.exe

.exe 11.6MB

Döner.exe

IMPHASH 29d355a826a3c44a0770282ffc62f94b
SHA256 b9baaf9822686896bad2c7d8a557acbb1fe98b008ea73f9479a9de11134b8065
MD5 e426fdf0a00ce121d4127b8e47b46463
SHA1 485e6b110fbc87b73755f53759fe57a779432430
SHA512 b00452fab346bf1e362d2116be2ad4c916b04f69e7019d56d45b488833dfea9bc1f34bc506b820e757d65cc4db541cb295de6e82225988d360103803cb5465c0
SSDEEP 196608:o00UXTv+UW/RCjBrb8Mz5NWnwTjuU5TPEg+:o6XTvRwCjhwaPbTjuUM
TLSH
T10CC6CE61869C8B4DF06AF038C5876217A7F1BC0C5721DFCB9AD09CB70E2F690F56A619
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8827444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA InternetOpenUrlA HttpOpenRequestA HttpQueryInfoA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

kernel32

SizeofResource MoveFileA GetFileAttributesExA FindFirstFileA SetWaitableTimer GetConsoleScreenBufferInfo CreateNamedPipeA SetConsoleTitleA GetCurrentProcess GetStdHandle CreateWaitableTimerW WriteFile OutputDebugStringA TerminateProcess GetModuleFileNameW GetProcessId FindNextFileA SetThreadPriority ExpandEnvironmentStringsA GetEnvironmentVariableA FindClose CreateMutexA GetVolumeInformationA WaitForSingleObject GetModuleHandleA DisconnectNamedPipe RtlCaptureStackBackTrace OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetModuleHandleExA GetTickCount64 GetLastError AttachConsole GetFileAttributesA Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread LoadLibraryA LockResource DeleteFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle WritePrivateProfileStringA CreateThread GetWindowsDirectoryA LoadResource FindResourceW Module32FirstW GetLocalTime FillConsoleOutputAttribute GetThreadContext GetProcAddress GlobalLock ReadProcessMemory GetCurrentProcessId GetModuleHandleW FreeLibrary WideCharToMultiByte GetConsoleWindow Module32NextW CreateProcessA SetConsoleOutputCP CreateDirectoryA CreateWaitableTimerExW GetTempFileNameA SetConsoleCursorPosition GetPrivateProfileIntA GetPrivateProfileStringA GetTickCount GlobalUnlock AllocConsole IsDebuggerPresent ConnectNamedPipe CheckRemoteDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess MultiByteToWideChar GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter CompareFileTime CopyFileA ExitProcess FillConsoleOutputCharacterA GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameA ReadFile HeapReAlloc RtlUnwind IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime SetEnvironmentVariableW SetStdHandle InitializeCriticalSectionEx GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFileW GetProcessHeap HeapSize WriteConsoleW SetEndOfFile ReadConsoleW RtlPcToFileHeader RaiseException LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI

user32

FindWindowW TranslateMessage BringWindowToTop SetWindowLongW SendInput GetCursorPos SetForegroundWindow GetClientRect SetLayeredWindowAttributes EnumWindows GetForegroundWindow MessageBoxA SetWindowDisplayAffinity GetWindowTextA PeekMessageW EmptyClipboard ReleaseCapture UpdateWindow SetClipboardData PostQuitMessage EnumDisplaySettingsW SetFocus keybd_event CloseClipboard GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode SetCursorPos GetClipboardData GetWindowThreadProcessId DefWindowProcW MapVirtualKeyW MonitorFromPoint DestroyWindow SetWindowPos GetMonitorInfoW MonitorFromWindow SetActiveWindow CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState OpenClipboard DispatchMessageW FindWindowA

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA ShellExecuteExA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

shlwapi

PathRemoveFileSpecA

winmm

timeBeginPeriod PlaySoundA

dbghelp

SymSetOptions SymInitialize SymFromAddr

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Döner.exe

wininet

ole32

kernel32

user32

comdlg32

advapi32

shell32

d3d11

d3dcompiler_47

winhttp

dwmapi

shlwapi

winmm

dbghelp

imm32

generic