funny[.]exe | Triage™

General

Target
funny.exe
Size 120KB
Sample260804-vwl67aec37
SHA256 b253fb244c9c8c4fdd69c0877c663a54c94f9e3a1b75ba544090e2a92cb673de
MD5 fc32e597cece098d4819128ef942b0f3
SHA1 7b42a3aa0e1bb6b3b88d84dff607ac794d6da7f3
SHA512 7aac377e020e46c7f3a9ff3e772661ae0c47a158fce52a7c0b1f3e027f8c914886e9864617f37330c4e9a5c3e8ea9bfaae241b72e0a98f68e93b3b7a9ed0068b
SSDEEP 3072:5SDZLJTXozGiBdhiG3/cxeVuDA0BpUN7yD4d7B7N:ciB6GkxauD6eI7BR
TLSH
T172C37D07B5C1C471E9B6193118B4DBB18A3FB9701F609EEB638416BA5E342C09E36E77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
funny.exe

File Explorer

funny.exe

.exe 120KB

funny.exe

IMPHASH 28f263db4c6b0b1f42f46672ebcb3755
SHA256 b253fb244c9c8c4fdd69c0877c663a54c94f9e3a1b75ba544090e2a92cb673de
MD5 fc32e597cece098d4819128ef942b0f3
SHA1 7b42a3aa0e1bb6b3b88d84dff607ac794d6da7f3
SHA512 7aac377e020e46c7f3a9ff3e772661ae0c47a158fce52a7c0b1f3e027f8c914886e9864617f37330c4e9a5c3e8ea9bfaae241b72e0a98f68e93b3b7a9ed0068b
SSDEEP 3072:5SDZLJTXozGiBdhiG3/cxeVuDA0BpUN7yD4d7B7N:ciB6GkxauD6eI7BR
TLSH
T172C37D07B5C1C471E9B6193118B4DBB18A3FB9701F609EEB638416BA5E342C09E36E77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wevtapi

EvtOpenLog EvtClearLog EvtClose

advapi32

AdjustTokenPrivileges RegCloseKey RegEnumKeyExW GetTokenInformation RegOpenKeyExW RegSetValueExW OpenProcessToken

kernel32

DecodePointer CreateFileW GetModuleHandleExW GetCurrentProcess CloseHandle SetFirmwareEnvironmentVariableW GetProcAddress GetModuleHandleW GetTickCount QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetConsoleMode GetConsoleOutputCP RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess WriteConsoleW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers

ntdll

RtlUnwind

Sharing