3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
3.exe
Size 1.1MB
Sample260803-pgzwvaap6t
SHA256 bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40
MD5 bf50325f1dbd215e1c734c00b251789d
SHA1 4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34
SHA512 d35023b758690b6c43fb46fbe3ed262f90578f040d78f1ffb7be9af5d3fc49de403ebb34654c7a023f6e01d71b9dc402f693fd3a999d7f916872d7ad180463d8
SSDEEP 24576:lC0Pf7dNvVC2cuWnd/ewT96mCTucMVvu8QmCgFqk:lvPfanHT95wpm9
TLSH
T18135BF15A3E401B8E92BC278CB9A4233E7B274551774AACF0759EA553F33AD06F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3.exe

File Explorer

3.exe

.exe 1.1MB

3.exe

IMPHASH 8c0ed5311e0eeba51b4c1a13e4263081
SHA256 bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40
MD5 bf50325f1dbd215e1c734c00b251789d
SHA1 4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34
SHA512 d35023b758690b6c43fb46fbe3ed262f90578f040d78f1ffb7be9af5d3fc49de403ebb34654c7a023f6e01d71b9dc402f693fd3a999d7f916872d7ad180463d8
SSDEEP 24576:lC0Pf7dNvVC2cuWnd/ewT96mCTucMVvu8QmCgFqk:lvPfanHT95wpm9
TLSH
T18135BF15A3E401B8E92BC278CB9A4233E7B274551774AACF0759EA553F33AD06F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

617248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Projects\Moonshine-Csharp\out\native\aethsync.pdb

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CompareStringEx CompareStringOrdinal CreateEventExW DuplicateHandle FindNLSStringEx FindStringOrdinal FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetStdHandle GetThreadPriority LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetProcAddress RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

_stricmp strcpy strlen strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table abort _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv terminate __p___argc _exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfx

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic