smie[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
smie.exe
Size 1.5MB
Sample260803-3sraqsdl2v
SHA256 33bd9ee8a26afd01db42caf94af48a5cc3c12ffe30113be5efc22b5e8dbe8bcc
MD5 aafa7cd9f058d719b25d97f4d1a1084b
SHA1 b384eca3339efb2c53c1ccd09ff8da2ad07459e1
SHA512 14e460db003f013903a2616c677d3b3c7a68100d76b22fbe139c943fd1cec54043b41d5118c1d718b23183d3b4664c474cf23aa0417e9325bce8c7a9f47bfe88
SSDEEP 24576:tiM3N/DLFQbNEchXpP72WVTC4NMV/UleACpOh1LquYeVACENc2QJZve1V4vdqTcJ:uhfLmOkQJGV4v0THK+jhMVP
TLSH
T1B065AF50BB8682B7C65321748837E31F916AEE022B2495C7F3943F4F5D712D26E3939A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
smie.exe

File Explorer

smie.exe

.exe 1.5MB

smie.exe

IMPHASH 396857373534369711b8d2398975e99d
SHA256 33bd9ee8a26afd01db42caf94af48a5cc3c12ffe30113be5efc22b5e8dbe8bcc
MD5 aafa7cd9f058d719b25d97f4d1a1084b
SHA1 b384eca3339efb2c53c1ccd09ff8da2ad07459e1
SHA512 14e460db003f013903a2616c677d3b3c7a68100d76b22fbe139c943fd1cec54043b41d5118c1d718b23183d3b4664c474cf23aa0417e9325bce8c7a9f47bfe88
SSDEEP 24576:tiM3N/DLFQbNEchXpP72WVTC4NMV/UleACpOh1LquYeVACENc2QJZve1V4vdqTcJ:uhfLmOkQJGV4v0THK+jhMVP
TLSH
T1B065AF50BB8682B7C65321748837E31F916AEE022B2495C7F3943F4F5D712D26E3939A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

990407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryW SetCurrentDirectoryW GetDateFormatW FlushFileBuffers GetLocalTime CreateSemaphoreW GetCurrentThreadId WaitForMultipleObjects InterlockedIncrement InterlockedDecrement VirtualFree GetCurrentProcess VirtualAlloc InterlockedExchange SetThreadPriority GetThreadPriority GetCurrentThread GetTickCount GetVersionExW CreateThread SetEndOfFile GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID InitializeCriticalSectionAndSpinCount LoadLibraryA GetCurrentDirectoryA CreateFileA CreateMutexW GetFileInformationByHandle GetFullPathNameA GetStringTypeA GetModuleFileNameA HeapSize GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapCreate GetFileType GetStdHandle SetHandleCount SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP CompareStringW CompareStringA GetStringTypeW LCMapStringW LCMapStringA RaiseException RtlUnwind GetStartupInfoA GetCommandLineA ExitProcess LocalFree FormatMessageW WideCharToMultiByte lstrcmpiW lstrlenW WriteFile lstrcpynA lstrlenA GetFileSize FindNextFileW FindClose GetFileSizeEx MultiByteToWideChar GetProcessHeap HeapFree HeapAlloc FindFirstFileW OutputDebugStringW QueryPerformanceCounter ReadFile CreateEventW CreateFileW SetFilePointer ReleaseSemaphore MulDiv lstrcmpW Sleep GetModuleHandleW lstrcpyW FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime GetCPInfo HeapReAlloc GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess ExitThread DeleteFileW GetProcAddress LoadLibraryW InterlockedCompareExchange FreeLibrary DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CloseHandle QueryPerformanceFrequency ResetEvent GetLastError SetEvent WaitForSingleObject CreateDirectoryW PeekNamedPipe SetEnvironmentVariableA

user32

wsprintfW GetSystemMetrics IsWindowVisible SetWindowPos SystemParametersInfoW GetWindowRect DispatchMessageW DefWindowProcW SetWindowTextW LoadIconW TranslateMessage BeginPaint DeleteMenu PostMessageW PostQuitMessage GetMessageW ShowCursor EndPaint EnumDisplaySettingsW GetMonitorInfoW AdjustWindowRect UpdateWindow CreateWindowExW ShowWindow GetCursorPos GetAsyncKeyState InvalidateRect PeekMessageW GetDesktopWindow RedrawWindow SetWindowLongW MonitorFromWindow ReleaseDC GetClassNameW SetCursorPos MessageBoxW SendMessageW GetSystemMenu RegisterWindowMessageW MsgWaitForMultipleObjects GetQueueStatus PostThreadMessageW GetMessageExtraInfo ClientToScreen ScreenToClient ChangeDisplaySettingsExW ChangeDisplaySettingsW SetForegroundWindow LoadCursorW FindWindowW GetClientRect EnumWindows GetDC RegisterClassExW SetRect

gdi32

SelectObject DeleteObject DeleteDC GetGlyphOutlineW GetObjectW GetDeviceCaps StretchDIBits GetStockObject GetTextMetricsW SetTextColor CreateFontIndirectW SetBkColor SetBkMode CreateCompatibleDC SetMapMode AddFontResourceExW RemoveFontResourceExW

comdlg32

GetSaveFileNameW

advapi32

CryptReleaseContext RegCloseKey CryptGetHashParam CryptAcquireContextW RegOpenKeyExW CryptCreateHash CryptDestroyHash CryptHashData RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitialize CoTaskMemAlloc CoFreeUnusedLibraries CoCreateInstance

dsound

ord11

winmm

timeKillEvent timeBeginPeriod timeEndPeriod timeGetTime timeSetEvent

ogg

ogg_page_eos ogg_sync_buffer ogg_stream_pagein ogg_stream_packetout ogg_page_serialno ogg_sync_wrote ogg_sync_init ogg_stream_clear ogg_sync_clear ogg_sync_pageout ogg_stream_init ogg_page_granulepos

vorbis

vorbis_synthesis_read vorbis_synthesis_blockin vorbis_synthesis_pcmout vorbis_comment_clear vorbis_synthesis_headerin vorbis_info_init vorbis_block_clear vorbis_dsp_clear vorbis_info_clear vorbis_synthesis_init vorbis_synthesis vorbis_comment_init vorbis_block_init

imm32

ImmSetOpenStatus ImmGetCompositionStringW ImmReleaseContext ImmGetContext

canvas

?ResizeWindow@Canvas@@QAEJHH@Z ?Draw@Canvas@@QAE_NHHHPBE@Z ?Render@Canvas@@QAE_NAAUtagRECT@@@Z ??0Canvas@@QAE@PAUHWND__@@PAVULog@@HHHH_N@Z ??1Canvas@@QAE@XZ ?ResizeScreen@Canvas@@QAEJHH@Z

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=49, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=84, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=204, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=123, productName=VS2005 build 50727, version=50727,

count=274, id=1, productName=Unmarked objects,

count=4, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=132, productName=VS2008 build 21022, version=21022,

count=81, id=138, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,