Soda[.]lol[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Soda.lol.exe
Size 8.3MB
Sample260802-2lmtasgp2v
SHA256 cf4c92f7409e378c06c409d58ae4ee6db3e4b6a09ff6300daa321df08723c11d
MD5 994abf20d80d9f211949e68a0a699840
SHA1 254e547f1e781574209f78ad39a240eee5f52aa1
SHA512 84c442a7f7fd42128aaabf6cfc2eaf13876f56602ba89475687aaff9ad4d0b043b2fcbcb8881d1be4edff8c718c9aabb399c584bababb15ca23b063bced09ecb
SSDEEP 98304:g7EgzCNTRE3gtgG4XVf+u+wcvu0pVST4k:g7EgzCNTRE3gtgG4XVGuXI144k
TLSH
T1CF96D4257B5B996CD19BC47482478A62492030DB0B39B9FF4498963C2F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Soda.lol.exe

File Explorer

Soda.lol.exe

.exe 8.3MB

Soda.lol.exe

IMPHASH c30a5ad9c735db17c1d4b00bea451792
SHA256 cf4c92f7409e378c06c409d58ae4ee6db3e4b6a09ff6300daa321df08723c11d
MD5 994abf20d80d9f211949e68a0a699840
SHA1 254e547f1e781574209f78ad39a240eee5f52aa1
SHA512 84c442a7f7fd42128aaabf6cfc2eaf13876f56602ba89475687aaff9ad4d0b043b2fcbcb8881d1be4edff8c718c9aabb399c584bababb15ca23b063bced09ecb
SSDEEP 98304:g7EgzCNTRE3gtgG4XVf+u+wcvu0pVST4k:g7EgzCNTRE3gtgG4XVGuXI144k
TLSH
T1CF96D4257B5B996CD19BC47482478A62492030DB0B39B9FF4498963C2F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5998336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Soda_lol.pdb

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW RegOpenKeyExW EventWriteTransfer RegQueryValueExW RegCloseKey IsValidSid GetLengthSid CopySid OpenProcessToken GetTokenInformation EventSetInformation EventRegister EventUnregister

ntdll

NtCreateNamedPipeFile NtOpenFile RtlGetVersion NtReadFile NtQueryInformationProcess RtlNtStatusToDosError NtWriteFile

kernel32

QueryPerformanceFrequency GetModuleHandleA HeapReAlloc WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead SetUnhandledExceptionFilter SetFileTime GetModuleHandleW RtlUnwindEx SetFileInformationByHandle FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess FindClose FindFirstFileExW RtlPcToFileHeader RaiseException GetFileAttributesW GetModuleFileNameW GetLastError LoadLibraryExW FreeLibrary GetFileInformationByHandle GetConsoleMode GetCommandLineW FlsAlloc SetHandleInformation GetCurrentDirectoryW GetCurrentThread FlsGetValue GetProcAddress ReadFileEx AddVectoredExceptionHandler CreateDirectoryW FlsSetValue GetFullPathNameW SetLastError GetCurrentThreadId FlsFree EncodePointer CloseHandle QueryPerformanceCounter CreateEventW CreateFileW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree GetStdHandle SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetSystemInfo GetEnvironmentVariableW ReadFile CreateThread GetOverlappedResult GlobalMemoryStatusEx K32GetPerformanceInfo GetCurrentProcessId GetCurrentProcess AcquireSRWLockExclusive GetSystemTimeAsFileTime GetUserDefaultUILanguage FormatMessageW LoadLibraryExA DuplicateHandle VirtualQueryEx GetEnvironmentStringsW LoadLibraryW LoadLibraryA RtlCaptureContext RtlLookupFunctionEntry Sleep CreateProcessW GetWindowsDirectoryW SetThreadStackGuarantee lstrlenW LocalFree InitializeCriticalSectionEx OpenProcess GetProcessTimes GetExitCodeProcess GetSystemTimes GetProcessIoCounters GetSystemDirectoryW GetFileInformationByHandleEx CancelIo HeapAlloc ReleaseSRWLockExclusive ReadProcessMemory DeleteCriticalSection GetSystemTimePreciseAsFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW LCIDToLocaleName RtlVirtualUnwind

user32

ChangeDisplaySettingsExW SetWindowPlacement GetWindowPlacement RegisterClassExW GetMessageA DispatchMessageA RegisterWindowMessageA GetWindow SetParent MsgWaitForMultipleObjectsEx SetCapture MapWindowPoints SetFocus EnumChildWindows ShowWindow GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW IsProcessDPIAware GetDC ReleaseCapture DestroyIcon ReleaseDC SetPropW FindWindowExW RegisterTouchWindow IsWindowEnabled CloseTouchInputHandle GetTouchInputInfo SystemParametersInfoA SetWindowRgn RegisterRawInputDevices GetRawInputData SetWindowDisplayAffinity VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu TrackPopupMenu PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout ToUnicodeEx SetWindowLongW EnableMenuItem MonitorFromPoint EnumDisplayMonitors GetSystemMenu GetWindowTextLengthW EnableWindow GetKeyState GetAsyncKeyState GetWindowTextW GetKeyboardState MapVirtualKeyExW DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW SendInput SetForegroundWindow IsWindow CreateWindowExW GetMenu AdjustWindowRectEx GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos ShowCursor SetCursor TrackMouseEvent SystemParametersInfoW ClipCursor FillRect GetClipCursor GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient LoadCursorW PostMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW IsWindowVisible ValidateRect SetWindowTextW IsIconic SendMessageW RedrawWindow AdjustWindowRect TranslateAcceleratorW DestroyWindow

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

gdi32

CombineRgn CreateCompatibleDC SelectObject BitBlt SetTextColor SetBkMode CreateDIBSection CreateRectRgn DeleteObject CreateSolidBrush DeleteDC GetDeviceCaps

ole32

OleInitialize CoCreateFreeThreadedMarshaler RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize RegisterDragDrop

shlwapi

SHCreateMemStream

shell32

CommandLineToArgvW SHAppBarMessage ShellExecuteW DragFinish DragQueryFileW SHGetKnownFolderPath

combase

CoTaskMemFree CoTaskMemAlloc

ws2_32

WSAStartup WSACleanup freeaddrinfo closesocket getaddrinfo WSAGetLastError WSASocketW connect send

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

pdh

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA PdhCollectQueryData PdhCloseQuery PdhEnumObjectsA PdhRemoveCounter

powrprof

CallNtPowerInformation

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

psapi

GetProcessMemoryInfo GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

trunc floor __setusermatherr round pow roundf

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp wcscmp strcpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _set_app_type _configure_narrow_argv _initterm _initialize_onexit_table _initterm_e exit _exit __p___argc __p___argv terminate _cexit _c_exit abort _register_onexit_function _seh_filter_exe _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale