2[.]exe | Triage™

General

Target
2.exe
Size 440KB
Sample260804-pd66raek4x
SHA256 3c85c4a7b98e6e056357c7382a1c204a18d5049d78d2adccfaea64eb30c9f5ca
MD5 5dc18659a070be29b96d701fbce757be
SHA1 22c430566777119d69be850ee95533b66261fe90
SHA512 0da18e61db84cae3973aa0a5b9b6c915624efe234484f55dd705ccbaab0cd22a35759ccc90498754859392404bcb83656cf7ae2274644035279787fd7a77606a
SSDEEP 12288:MIIvNw/88e4IJfFT0cOL6b80tYtNa0HJJ:jIrJO70tga0HL
TLSH
T16EA47D878754E4B7D1F36773F4B622401BBB7528B55218EC81BE818606E309D4B8EFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2.exe

File Explorer

2.exe

.exe 440KB

2.exe

IMPHASH eaa8d0c0c392dd891728fb52fd8791e1
SHA256 3c85c4a7b98e6e056357c7382a1c204a18d5049d78d2adccfaea64eb30c9f5ca
MD5 5dc18659a070be29b96d701fbce757be
SHA1 22c430566777119d69be850ee95533b66261fe90
SHA512 0da18e61db84cae3973aa0a5b9b6c915624efe234484f55dd705ccbaab0cd22a35759ccc90498754859392404bcb83656cf7ae2274644035279787fd7a77606a
SSDEEP 12288:MIIvNw/88e4IJfFT0cOL6b80tYtNa0HJJ:jIrJO70tga0HL
TLSH
T16EA47D878754E4B7D1F36773F4B622401BBB7528B55218EC81BE818606E309D4B8EFA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA CreateEventW Sleep GetTickCount64 SetEvent LoadLibraryA QueryPerformanceFrequency GetSystemInfo GetWindowsDirectoryW GetProcAddress WaitForSingleObject GlobalMemoryStatusEx GetSystemTime QueryPerformanceCounter WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetTempPathW GetEnvironmentVariableW GetComputerNameW lstrlenW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP

user32

IsWindow GetDoubleClickTime GetForegroundWindow ReleaseDC GetSystemMetrics GetDC

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2.exe

kernel32

user32

advapi32

generic