external[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
external.exe
Size 5.0MB
Sample260805-a8e87asthy
SHA256 1e8cf581db4beb6d24ed09ca3d259cc453047e26c59643190bf429a13838bff6
MD5 8ccbdbf4b9d69eefbc5388f5df314de5
SHA1 41e684263f826450900a7d3fd4ebf86b1efdd80b
SHA512 59005b8c6c9d312dff2b216f350a206589502caf15e0c20b9d79a4c26d1c2e57194b3ec4c124aafc4558891ebb0886f21621f9b0826c14f3482bb9a93df847a9
SSDEEP 98304:0kXx2O/DEr9Rd5yo/Y7mgTm05AwJHE6heJX5lZqL9PlF:PXb/gRL5jg7PAmkLJTZqL1lF
TLSH
T1DA36AE42B392C5A9C166C238CA42D7A7E7313C080F2166EB36DC7E1E6F726D05E79B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
external.exe

File Explorer

external.exe

.exe 5.0MB

external.exe

IMPHASH 4d3a01f253345082f594981088917fbe
SHA256 1e8cf581db4beb6d24ed09ca3d259cc453047e26c59643190bf429a13838bff6
MD5 8ccbdbf4b9d69eefbc5388f5df314de5
SHA1 41e684263f826450900a7d3fd4ebf86b1efdd80b
SHA512 59005b8c6c9d312dff2b216f350a206589502caf15e0c20b9d79a4c26d1c2e57194b3ec4c124aafc4558891ebb0886f21621f9b0826c14f3482bb9a93df847a9
SSDEEP 98304:0kXx2O/DEr9Rd5yo/Y7mgTm05AwJHE6heJX5lZqL9PlF:PXb/gRL5jg7PAmkLJTZqL1lF
TLSH
T1DA36AE42B392C5A9C166C238CA42D7A7E7313C080F2166EB36DC7E1E6F726D05E79B51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1606816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\zyro\Desktop\RBX EXTERNAL\build\Zy's Spoofer.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlPcToFileHeader RtlCaptureContext RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry VerSetConditionMask RtlUnwind

kernel32

Sleep SwitchToThread GetConsoleWindow Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcmpiW SetThreadPriority GetCurrentThread ReadProcessMemory SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode QueryFullProcessImageNameW SetConsoleOutputCP GetExitCodeProcess DeleteFileA CreateDirectoryA GetComputerNameA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA WriteFile GetModuleFileNameW ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InitializeSListHead GetCurrentProcessId GlobalUnlock IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetSystemTimeAsFileTime GetCPInfo DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetFileInformationByHandleEx WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA GetModuleHandleW AreFileApisANSI WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW SetFileInformationByHandle SetEndOfFile GetCommandLineA GetEnvironmentStringsW ReadConsoleW GetACP IsValidCodePage GetCommandLineW GetFileType SetFilePointerEx GetStartupInfoW GetOEMCP GetConsoleOutputCP FlushFileBuffers GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 RaiseException IsProcessorFeaturePresent GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize FormatMessageA WakeAllConditionVariable LocalFree GetLocaleInfoEx CreateDirectoryW

user32

GetCursorPos GetAsyncKeyState SetCursorPos ReleaseDC ReleaseCapture MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow GetSystemMetrics SetWindowLongA SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetWindowThreadProcessId IsWindow EnumWindows IsWindowVisible ShowWindow SetForegroundWindow FindWindowA SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode

gdi32

GetDeviceCaps

advapi32

CryptCreateHash CryptDestroyHash CryptHashData CryptReleaseContext GetUserNameA CryptAcquireContextA CryptGetHashParam

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteW

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winmm

timeBeginPeriod PlaySoundA

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse