heras[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
heras.exe
Size 710KB
Sample260804-rf46aasdmb
SHA256 4c9dfdcf21998d5012eb939188ff8cd02e34d9b4ca6cc2ad477b17b333ba0553
MD5 549185cce1118d9ac47abf7bef811a64
SHA1 8ad694dada1b636b8a0270257ccff6056c6e13b5
SHA512 28c250ed25d640b0c58015bebc624163ec0ce7cbff1586400777acdd5c61f6894d6527ea0f5711c6b74bc9b82624cf659b36fbf18e8e7f8d8e90a017312b4051
SSDEEP 12288:r6RmK/1lUQeBkK/GSvDMwgCfWH+AavfGzrAIM1PJDhd:+RmK/LUQerGSvDMwgCfqofGzreJDhd
TLSH
T1E3F46C66ABE405FDC067C179C9574603F7B6B80A1360AACF07D54AA62F23BE55E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
heras.exe

File Explorer

heras.exe

.exe 710KB

heras.exe

IMPHASH 93ff0dc86a8802927a0ebeff536ef42e
SHA256 4c9dfdcf21998d5012eb939188ff8cd02e34d9b4ca6cc2ad477b17b333ba0553
MD5 549185cce1118d9ac47abf7bef811a64
SHA1 8ad694dada1b636b8a0270257ccff6056c6e13b5
SHA512 28c250ed25d640b0c58015bebc624163ec0ce7cbff1586400777acdd5c61f6894d6527ea0f5711c6b74bc9b82624cf659b36fbf18e8e7f8d8e90a017312b4051
SSDEEP 12288:r6RmK/1lUQeBkK/GSvDMwgCfWH+AavfGzrAIM1PJDhd:+RmK/LUQerGSvDMwgCfqofGzreJDhd
TLSH
T1E3F46C66ABE405FDC067C179C9574603F7B6B80A1360AACF07D54AA62F23BE55E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

373904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\danar\OneDrive\Рабочий стол\Sources\Add\coach\x64\Release\coach.pdb

ws2_32

WSACleanup freeaddrinfo recv shutdown inet_pton htons ioctlsocket select WSAGetLastError closesocket getaddrinfo send socket connect WSAStartup

bcrypt

BCryptGenRandom

shell32

SHGetFolderPathA ShellExecuteExA

kernel32

HeapReAlloc HeapSize FlushFileBuffers GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetStringTypeW GetFileSizeEx GetConsoleOutputCP SetFilePointerEx WriteConsoleW GetFileType GetTimeZoneInformation Sleep GetLastError CloseHandle CreateProcessA WriteFile CreateFileA DeleteFileA GetTickCount GetModuleFileNameA GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetConsoleMode GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindFirstFileExW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo GetStdHandle GetModuleFileNameW ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW

user32

GetLastInputInfo

advapi32

GetUserNameA