Recoil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Recoil.exe
Size 1.5MB
Sample260802-aj461sam2x
SHA256 8a329c239bcf8c95bd08b0b235a45d6a699cb7e7b86d05f85b4a76067d26024b
MD5 dfccbee2aa6f884e4d45b8f87770710b
SHA1 ef46e9c76ea0f16efba5440c4c51b400bb764cda
SHA512 e1127d25c4d51b907d2e3bbd93d25f705228df6b83d2d0f1278b28638e464a4082fb9c060fb14cfa60262483845890f261a5a05611d3f75087b1d6dc7a9b2704
SSDEEP 12288:YTerheRTeRlsiiUl+pRRMYmeV8hXU0xOxUp8Dk6LM0YJhYpeiyAxUp8D4WdfMNg3:0uB+PrV8hk0+YzUTNZqiPvRpmL1
TLSH
T1EC75AF13F722439CC61A7838D6A1C35BB7353C506F15E28B72E92A949EDB1F01EE62D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Recoil.exe

File Explorer

Recoil.exe

.exe 1.5MB

Recoil.exe

IMPHASH e3869cbae76e3cd458781c9c6f8ec0ec
SHA256 8a329c239bcf8c95bd08b0b235a45d6a699cb7e7b86d05f85b4a76067d26024b
MD5 dfccbee2aa6f884e4d45b8f87770710b
SHA1 ef46e9c76ea0f16efba5440c4c51b400bb764cda
SHA512 e1127d25c4d51b907d2e3bbd93d25f705228df6b83d2d0f1278b28638e464a4082fb9c060fb14cfa60262483845890f261a5a05611d3f75087b1d6dc7a9b2704
SSDEEP 12288:YTerheRTeRlsiiUl+pRRMYmeV8hXU0xOxUp8Dk6LM0YJhYpeiyAxUp8D4WdfMNg3:0uB+PrV8hk0+YzUTNZqiPvRpmL1
TLSH
T1EC75AF13F722439CC61A7838D6A1C35BB7353C506F15E28B72E92A949EDB1F01EE62D4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

440444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\buddy\Downloads\Recoil\bin\Recoil.pdb

kernel32

GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW GlobalUnlock IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte GlobalLock GlobalFree MultiByteToWideChar GetTickCount64 GetPrivateProfileStringA GlobalAlloc CreateDirectoryA GetModuleHandleW WritePrivateProfileStringA IsDebuggerPresent

user32

CloseClipboard OpenClipboard SetCursorPos ShowWindow GetKeyState IsWindowUnicode GetMessageExtraInfo EmptyClipboard GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCursor GetClientRect GetClipboardData GetAsyncKeyState ScreenToClient SetClipboardData GetDC SendInput GetCursorPos ReleaseCapture UpdateWindow RegisterClassExA ReleaseDC SetWindowDisplayAffinity DefWindowProcW DestroyWindow SetWindowPos PostQuitMessage DispatchMessageW SetTimer PeekMessageW CreateWindowExA SetLayeredWindowAttributes TranslateMessage SetCapture UnregisterClassA GetSystemMetrics

gdi32

GetPixel

shell32

SHGetFolderPathA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler _CxxThrowException memcpy memcmp __current_exception strstr __std_terminate __std_exception_copy __std_exception_destroy memmove memchr memset

api-ms-win-crt-convert-l1-1-0

atof strtof strtol

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _register_onexit_function _initterm_e exit _exit _invoke_watson _c_exit _register_thread_local_exe_atexit_callback _errno _initialize_onexit_table terminate _initialize_narrow_environment _configure_narrow_argv _crt_atexit _initterm

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-stdio-l1-1-0

__p__commode fread _wfopen __stdio_common_vsprintf fwrite __stdio_common_vsscanf __stdio_common_vfprintf ftell __stdio_common_vsprintf_s fseek _set_fmode fclose fflush __acrt_iob_func

api-ms-win-crt-math-l1-1-0

roundf sqrtf log fmodf cosf pow powf sinf ceilf logf acosf __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strcpy_s strncpy strncmp strcmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale