masonclient[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
masonclient.exe
Size 375KB
Sample260804-l8brjsszhy
SHA256 fa810de277e10d2e363ecc96eb78a89d3dea575c8d77e4defaccae9a02024037
MD5 0daf28c65a82386e3c73e17f0b50258b
SHA1 20a9b3784f7dc0a17323550810a110d6ae80b067
SHA512 477b2191cfad9a1cd015070c73e4ef272dd0432e89031ec8006fe3eba325d6e5e7e43ece54854ca6bf0dbd3f376cf4ac4d4baf35732a86148004d8b477b32c20
SSDEEP 6144:z1xYcygEBwZYI0V84n6vosRnnHC4MyGOjFi5YMS3mxTn5AfGRF:zw0EoYI6/n6gsRnnmyGOjFif5afGRF
TLSH
T16984F11176E0C572E8F7013148F5EAB98B3EF8750B515CEF238816B90E246D19A366EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
masonclient.exe

File Explorer

masonclient.exe

.exe 375KB

masonclient.exe

IMPHASH 2b94e23e7baa034d7decb21d46cbf770
SHA256 fa810de277e10d2e363ecc96eb78a89d3dea575c8d77e4defaccae9a02024037
MD5 0daf28c65a82386e3c73e17f0b50258b
SHA1 20a9b3784f7dc0a17323550810a110d6ae80b067
SHA512 477b2191cfad9a1cd015070c73e4ef272dd0432e89031ec8006fe3eba325d6e5e7e43ece54854ca6bf0dbd3f376cf4ac4d4baf35732a86148004d8b477b32c20
SSDEEP 6144:z1xYcygEBwZYI0V84n6vosRnnHC4MyGOjFi5YMS3mxTn5AfGRF:zw0EoYI6/n6gsRnnmyGOjFif5afGRF
TLSH
T16984F11176E0C572E8F7013148F5EAB98B3EF8750B515CEF238816B90E246D19A366EF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SizeofResource InitializeCriticalSectionEx WaitForSingleObject FreeResource MultiByteToWideChar GetLastError LoadLibraryA LockResource GlobalAlloc GlobalFree CloseHandle CreateThread LoadResource FindResourceW DecodePointer GetProcAddress GlobalLock DeleteCriticalSection GetCurrentProcessId GetModuleHandleW GlobalUnlock TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer WriteConsoleW FlushFileBuffers GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc HeapSize WideCharToMultiByte LCMapStringW CompareStringW HeapAlloc TlsSetValue SetLastError RtlUnwind LocalFree LeaveCriticalSection EnterCriticalSection RaiseException HeapFree SetStdHandle GetConsoleOutputCP GetConsoleMode GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType CreateFileW SetFilePointerEx LoadLibraryExW OutputDebugStringW FreeLibrary TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

user32

UnhookWinEvent SetWinEventHook SystemParametersInfoW PostQuitMessage KillTimer DrawTextW GetClientRect LoadCursorW TranslateMessage EnumWindows SetTimer DispatchMessageW IsWindow ShowWindow RegisterClassExW CreateWindowExW SetWindowPos DefWindowProcW EndPaint BeginPaint GetAncestor IsWindowVisible GetWindowLongW GetWindowThreadProcessId GetMessageW DestroyWindow PostMessageW InvalidateRect

ole32

OleInitialize CreateStreamOnHGlobal

oleaut32

SafeArrayDestroy VariantInit SysFreeString SysAllocString SafeArrayUnaccessData SafeArrayCreate SafeArrayCreateVector SafeArrayAccessData VariantClear

gdiplus

GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipLoadImageFromStreamICM GdipSetPixelOffsetMode GdipDrawLine GdipSetInterpolationMode GdipSetSmoothingMode GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipCloneImage GdipGetImageHeight GdiplusStartup GdiplusShutdown