ApexData[.]exe | Triage™

General

Target
ApexData.exe
Size 5.1MB
Sample260804-aw5cjsab63
SHA256 43f46c8c3c89b8386e72f7ff2350a77c2230cffdb8a7398c6e4236d46891665e
MD5 22f79b02e62926e5b7b061cda7a1e335
SHA1 7d7ed3b9b33f277cde91ed0f45444aac3d8e1e5b
SHA512 a68dd94816d296b033e9f08dd55654c3c2180df2ae2544bb2e5193fb54e223ebc2ce1cb2311dbccd90b919ed98cb576f4decb8ddb2edd944f6451936b15c6c3e
SSDEEP 49152:NYnruq6M7eSWmUwPGZJpTZUhUXU9nPHCKqtIOFhF0SWcT96PyZa0VkMSWchOn8jo:unv7nt2JXJ0Sj4QA
TLSH
T1B0368E17B3A800F8D167D17CC9578607E7B278051361ABDB17D08A6A2F27BE16B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ApexData.exe

File Explorer

ApexData.exe

.exe 5.1MB

ApexData.exe

IMPHASH acc85d0644660b658e701467e39f1633
SHA256 43f46c8c3c89b8386e72f7ff2350a77c2230cffdb8a7398c6e4236d46891665e
MD5 22f79b02e62926e5b7b061cda7a1e335
SHA1 7d7ed3b9b33f277cde91ed0f45444aac3d8e1e5b
SHA512 a68dd94816d296b033e9f08dd55654c3c2180df2ae2544bb2e5193fb54e223ebc2ce1cb2311dbccd90b919ed98cb576f4decb8ddb2edd944f6451936b15c6c3e
SSDEEP 49152:NYnruq6M7eSWmUwPGZJpTZUhUXU9nPHCKqtIOFhF0SWcT96PyZa0VkMSWchOn8jo:unv7nt2JXJ0Sj4QA
TLSH
T1B0368E17B3A800F8D167D17CC9578607E7B278051361ABDB17D08A6A2F27BE16B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123456

Minor OS version

0

Major OS version

6

Entry point

44948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW CommandLineToArgvW

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

kernel32

WriteConsoleW SetEndOfFile SetUnhandledExceptionFilter GetCommandLineW CreateFileW WriteFile GetTempPathW CloseHandle WaitForSingleObject ExitProcess GetExitCodeProcess CreateProcessW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter RtlUnwind GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapSize RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ApexData.exe

shell32

advapi32

kernel32

generic