loginDemo[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loginDemo.exe
Size 897KB
Sample260804-rkaggasejb
SHA256 27af9a04137898d742fe7eea36b880e1c3076dca22d34128ff10cde55a928aa2
MD5 d0e649ee7b700205d7abd1c420a820fd
SHA1 e0195ec134735bdafdeb47fc3f3680e2b5542625
SHA512 394cd14591b92462ac7ea31467363b1932faf4674d558550f95c876b1a7fe8239da2adf47aeeed08143728e6b3ce2be3b8bbdee65c0b1de9ed2cd1efe76dfad5
SSDEEP 12288:1EtYEuH5AgT52cnBchqcDAOwgf/BxDUy0IGy3Vz5yY6viNY/mo4yapAI:1lT5JnBJcEOwKBFUy0rER5yl0oxt
TLSH
T103150297D9095099C2A68175ABAE7710E1F33812237CADFB428007327AE56CCB73F756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loginDemo.exe

File Explorer

loginDemo.exe

.exe 897KB

loginDemo.exe

IMPHASH 7039237b7a793c6f251298b6960cbb3c
SHA256 27af9a04137898d742fe7eea36b880e1c3076dca22d34128ff10cde55a928aa2
MD5 d0e649ee7b700205d7abd1c420a820fd
SHA1 e0195ec134735bdafdeb47fc3f3680e2b5542625
SHA512 394cd14591b92462ac7ea31467363b1932faf4674d558550f95c876b1a7fe8239da2adf47aeeed08143728e6b3ce2be3b8bbdee65c0b1de9ed2cd1efe76dfad5
SSDEEP 12288:1EtYEuH5AgT52cnBchqcDAOwgf/BxDUy0IGy3Vz5yY6viNY/mo4yapAI:1lT5JnBJcEOwKBFUy0rER5yl0oxt
TLSH
T103150297D9095099C2A68175ABAE7710E1F33812237CADFB428007327AE56CCB73F756
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler DeleteCriticalSection EnterCriticalSection FlsAlloc FlsFree FlsSetValue FlushInstructionCache GetCurrentProcess GetLastError GetModuleHandleExW GetModuleHandleW GetProcAddress GetSystemInfo InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA RemoveVectoredExceptionHandler SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fgets fwrite getchar putchar setvbuf

api-ms-win-crt-string-l1-1-0

memset strcspn strlen strncmp

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdataaa

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lmdata

Size

632KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vdata

Size

512B

Virtual Size

400B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loginDemo.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic