donotrun[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
donotrun.exe
Size 832KB
Sample260804-d8dbdavvht
SHA256 b7e9c5b63c2c22b58c792800a36025b878f88c79f3c81e0c990110da8c896672
MD5 e32ea9eab2fcc9ffbc1bda7fc569576f
SHA1 766f708ea5aaa80991c578eb94205df2c9f2a60a
SHA512 f8aec6d69fb5dff65d2053db0a972537dcdfbbec326fa2b2a81544ffaa20894b6c3e7156d8ec5299df5ebdba94046bb9cb588badee720ffc724fcff7534b14de
SSDEEP 12288:8tuueQ1++B54VDnoQQNzLMbSahYrFEpASGT0o5hnIJDH:8cU++YVDEXMXhYrKpALAIhnIJ
TLSH
T1BD05AD46F2E245FDE137A13985636317E7B47826073197DF23A04A16AFA77D08EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
donotrun.exe

File Explorer

donotrun.exe

.exe 832KB

donotrun.exe

IMPHASH 577b325e1b5b595ade4604f947b4d8f8
SHA256 b7e9c5b63c2c22b58c792800a36025b878f88c79f3c81e0c990110da8c896672
MD5 e32ea9eab2fcc9ffbc1bda7fc569576f
SHA1 766f708ea5aaa80991c578eb94205df2c9f2a60a
SHA512 f8aec6d69fb5dff65d2053db0a972537dcdfbbec326fa2b2a81544ffaa20894b6c3e7156d8ec5299df5ebdba94046bb9cb588badee720ffc724fcff7534b14de
SSDEEP 12288:8tuueQ1++B54VDnoQQNzLMbSahYrFEpASGT0o5hnIJDH:8cU++YVDEXMXhYrKpALAIhnIJ
TLSH
T1BD05AD46F2E245FDE137A13985636317E7B47826073197DF23A04A16AFA77D08EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daniel\Desktop\client-top\x64\Release\top-external.pdb

kernel32

OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle SetConsoleTitleA WriteProcessMemory GetModuleHandleA GetLastError GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

user32

GetForegroundWindow MessageBoxA GetWindowThreadProcessId FindWindowA

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Query_perf_frequency ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ _Thrd_sleep _Query_perf_counter _Xtime_get_ticks

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException __current_exception __current_exception_context memset __std_terminate __C_specific_handler __std_exception_copy memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback __p___argc exit terminate _initterm_e _initterm _seh_filter_exe _set_app_type __p___argv _cexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment _exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale