funny[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
funny.exe
Size 120KB
Sample260804-v49bpatthz
SHA256 c5eca93597a0cefd877272cb3111414937a45dd4b68d552a7a14dbc01ab41d0e
MD5 172daf9a5e560d38aef716dd771c7d47
SHA1 d999660333dd7791e37192d84593bd2a9572fc10
SHA512 035e244c7399d4a099f67978cc2450191323ae6139e56a6d6285d1dfeab2f98be7e89a7c82a27e24d3140a7919408a08a7b668fa4cce2fcc75fc7d812e49be5e
SSDEEP 3072:zuDZLJpyd1MGbi0CkO82fxK/uDi0BMVa7yD4QoFrON:EGbiyOJxsuD1eherk
TLSH
T1F2C38D07B9C1C472D976183118A4EBB58A3FB9B01F209EDB638416BE5E341C0AE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
funny.exe

File Explorer

funny.exe

.exe 120KB

funny.exe

IMPHASH 08a2eea2bdcc7ad59cf1062228d1b6d7
SHA256 c5eca93597a0cefd877272cb3111414937a45dd4b68d552a7a14dbc01ab41d0e
MD5 172daf9a5e560d38aef716dd771c7d47
SHA1 d999660333dd7791e37192d84593bd2a9572fc10
SHA512 035e244c7399d4a099f67978cc2450191323ae6139e56a6d6285d1dfeab2f98be7e89a7c82a27e24d3140a7919408a08a7b668fa4cce2fcc75fc7d812e49be5e
SSDEEP 3072:zuDZLJpyd1MGbi0CkO82fxK/uDi0BMVa7yD4QoFrON:EGbiyOJxsuD1eherk
TLSH
T1F2C38D07B9C1C472D976183118A4EBB58A3FB9B01F209EDB638416BE5E341C0AE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wevtapi

EvtOpenLog EvtClearLog EvtClose

advapi32

AdjustTokenPrivileges RegCloseKey RegEnumKeyExW GetTokenInformation RegOpenKeyExW RegSetValueExW OpenProcessToken

shell32

ShellExecuteW

kernel32

DecodePointer CreateFileW GetStdHandle GetConsoleMode GetCurrentProcess GetModuleFileNameW Sleep CloseHandle SetFirmwareEnvironmentVariableW GetProcAddress ExitProcess GetModuleHandleW GetTickCount QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetConsoleOutputCP FlushFileBuffers HeapReAlloc RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer WriteConsoleW WriteFile GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize

ntdll

RtlUnwind