Oxy Recoil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Oxy Recoil.exe
Size 606KB
Sample260804-jqthjaff36
SHA256 73557d7ec8fc05694702d2fe559099f100168aade6222e68088343892a7c3444
MD5 0c8cfc82a829bb80399669e0050e34e3
SHA1 baaf8a152d21d66c19a51093b64e86bbd2d83c9f
SHA512 10ca08b063e31fdf5fdece65665e2a46edaf1f74d318d6077baaf49f54d447dba1931187828b0d7cd48fd9df64205939d996b137c448e780b78df5094c8891e5
SSDEEP 12288:BF0uAgwfGOHzw2Fa5FlPOhbri+q+xzmOYiJnU6Y4bfZoHS:BFLAbfoIOFROm+uiJntf
TLSH
T19FD4BF42F1E900FCD03BD1789697B61BFA363848172055DB23E449992FE37E15BBAB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oxy Recoil.exe

File Explorer

Oxy Recoil.exe

.exe 606KB

Oxy Recoil.exe

IMPHASH 48eb90b49dbb0d6bb74d2b2f398fd892
SHA256 73557d7ec8fc05694702d2fe559099f100168aade6222e68088343892a7c3444
MD5 0c8cfc82a829bb80399669e0050e34e3
SHA1 baaf8a152d21d66c19a51093b64e86bbd2d83c9f
SHA512 10ca08b063e31fdf5fdece65665e2a46edaf1f74d318d6077baaf49f54d447dba1931187828b0d7cd48fd9df64205939d996b137c448e780b78df5094c8891e5
SSDEEP 12288:BF0uAgwfGOHzw2Fa5FlPOhbri+q+xzmOYiJnU6Y4bfZoHS:BFLAbfoIOFROm+uiJntf
TLSH
T19FD4BF42F1E900FCD03BD1789697B61BFA363848172055DB23E449992FE37E15BBAB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

457820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx MultiByteToWideChar MoveFileExW GlobalUnlock GetLastError CloseHandle AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree OutputDebugStringA GetModuleHandleW GetModuleHandleA WideCharToMultiByte GlobalLock CopyFile2 GlobalFree GetTickCount64 Sleep

user32

GetKeyState GetKeyNameTextA MapVirtualKeyW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos GetMessageExtraInfo GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout SendInput GetWindowLongW DefWindowProcW MonitorFromPoint DestroyWindow SetWindowPos CreateWindowExW CallNextHookEx GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW UpdateWindow PostQuitMessage SetWindowLongW MsgWaitForMultipleObjectsEx UnhookWindowsHookEx SetWindowsHookExW SetLayeredWindowAttributes LoadIconW TranslateMessage MapVirtualKeyA

gdi32

GetDeviceCaps

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_trylock _Cnd_signal _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strchr memcmp memchr memcpy memmove memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof strtol strtof

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _beginthreadex _cexit terminate _errno _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit abort _exit exit _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

strncpy isdigit strncmp wcslen tolower strlen strcmp

api-ms-win-crt-stdio-l1-1-0

fflush fputc fwrite __p__commode _set_fmode __stdio_common_vsscanf _wfopen fclose __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgetc __stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

pow logf log powf roundf __setusermatherr sinf ceilf cosf fmodf sqrtf acosf