Beg[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Beg.exe
Size 63.7MB
Sample260803-d2qccsbp2x
SHA256 b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923
MD5 657a5cb300e274e2e477f5a33c783522
SHA1 7775f7b04fc73e62b4cf1f60bf685901661c55b3
SHA512 835c1af74ceb3899f9c66ca77629a2b49cfca91315c073eea412d384fc267454b8bf8f348036d86d91508d6f82f8db28ef1a54cae342de13fb9788aaa6866a59
SSDEEP 786432:IpxXiUidVwFej7zBIsQmhiJe+bjVkacXrAB:IpxXiUi/wFevz6sQmhiJe+bhkm
TLSH
T124E7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Beg.exe

File Explorer

Beg.exe

.exe 63.7MB

Beg.exe

IMPHASH 20f8753be6463bfc0d4add487d3b411d
SHA256 b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923
MD5 657a5cb300e274e2e477f5a33c783522
SHA1 7775f7b04fc73e62b4cf1f60bf685901661c55b3
SHA512 835c1af74ceb3899f9c66ca77629a2b49cfca91315c073eea412d384fc267454b8bf8f348036d86d91508d6f82f8db28ef1a54cae342de13fb9788aaa6866a59
SSDEEP 786432:IpxXiUidVwFej7zBIsQmhiJe+bjVkacXrAB:IpxXiUi/wFevz6sQmhiJe+bhkm
TLSH
T124E7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nefes\source\repos\Loader\x64\Release\Loader.pdb

kernel32

GetModuleFileNameA SetConsoleTextAttribute SetConsoleTitleA GetStdHandle Sleep GetTempPathA DeleteFileA CloseHandle CreateProcessA RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

user32

MessageBoxA

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_copy __std_exception_destroy memcpy __current_exception_context _CxxThrowException __current_exception __std_terminate memset memmove

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fgetpos fwrite _fseeki64 fsetpos fread fgetc fclose fflush fputc _set_fmode __p__commode _get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _set_app_type _cexit __p___argv _exit _initialize_onexit_table _register_onexit_function _crt_atexit exit terminate _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment __p___argc _seh_filter_exe _invalid_parameter_noinfo_noreturn _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale