k3wfxjb[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
k3wfxjb.exe
Size 87KB
Sample260804-p27geser8w
SHA256 aacbdc4872a7220948e9063591e88ef413ea1f1eb1fe3d5011d8d951cc06fe21
MD5 f629efa7616254f7ecd90656985daa23
SHA1 ba8b5628ee56c96bf565feec761b14bce7c319cf
SHA512 7a20e5447297edd18f3b40cea597fafcbc8de8adfe960096dad2e02a1815d06673248f004cc473a2eded9335e2d636d070973e7589bba5d06e43cebfb1e99058
SSDEEP 1536:JhzEzirZlKnpSzAbvEpYOMmcsjZakYSpUeMFcPZlXh6+g0rUFvTxV:8irZlKw+uYOdtF9pUaPZlXh6+gEyTL
TLSH
T1D193071BB5C0A9B0D636C9B4C6969AE6C770B41597285FEB6323C18C1E101D7EFBB903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
k3wfxjb.exe

File Explorer

k3wfxjb.exe

.exe 87KB

k3wfxjb.exe

IMPHASH f56400450adb7bd8b1471e9b05617c4a
SHA256 aacbdc4872a7220948e9063591e88ef413ea1f1eb1fe3d5011d8d951cc06fe21
MD5 f629efa7616254f7ecd90656985daa23
SHA1 ba8b5628ee56c96bf565feec761b14bce7c319cf
SHA512 7a20e5447297edd18f3b40cea597fafcbc8de8adfe960096dad2e02a1815d06673248f004cc473a2eded9335e2d636d070973e7589bba5d06e43cebfb1e99058
SSDEEP 1536:JhzEzirZlKnpSzAbvEpYOMmcsjZakYSpUeMFcPZlXh6+g0rUFvTxV:8irZlKw+uYOdtF9pUaPZlXh6+gEyTL
TLSH
T1D193071BB5C0A9B0D636C9B4C6969AE6C770B41597285FEB6323C18C1E101D7EFBB903
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

X:\Mapper14 (14Stars)\Mapper.14Stars\build\Mapper.14Stars.pdb

kernel32

GetCurrentProcess GetLastError CloseHandle CreateThread IsWow64Process OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetConsoleMode WriteProcessMemory RtlAddFunctionTable Sleep LoadLibraryA VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess SetConsoleMode GetStdHandle SetConsoleTitleA GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception_context __current_exception _CxxThrowException __C_specific_handler __std_exception_destroy memcpy __std_exception_copy memmove

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fread setvbuf fgetpos fwrite fsetpos _fseeki64 fgetc fclose fflush _get_stream_buffer_pointers fputc ungetc __acrt_iob_func __stdio_common_vsprintf __p__commode __stdio_common_vfprintf _set_fmode

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _cexit _initterm _initterm_e _crt_atexit _exit _invoke_watson __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function system terminate _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit _get_initial_narrow_environment

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale