k300mrv[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
k300mrv.exe
Size 3.1MB
Sample260805-hzpehack4t
SHA256 6001f3feca2243b39550842e30b06ef760cfbcf1ea22f3f156451a950de2bca2
MD5 c0486344e7f93aab6803a072220a8795
SHA1 331134c924f9c549f68116c7d0566dbe5c0a57c7
SHA512 11ec7c51064defdb96558acc3355f5dbe2bb72a76423e2b64d674ea3f10cd94b02078733a95a5b99c616abeedd6bb1892fda7e4d89c0f07b1b41be72c9ea478e
SSDEEP 49152:ONEOdxOMlP98UajkM7nDGal4UDbTqMxtlDsaUc5i+jzeDYDK1+vgJM34:O9habd2AdxdsDOwM3
TLSH
T17CE5F103E35682E8C56B9538C6BA9F1BF7707840132497EB22E12E256F57AF01E7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
k300mrv.exe

File Explorer

k300mrv.exe

.exe 3.1MB

k300mrv.exe

IMPHASH 631012617c72182b332bc1cd5c0b6065
SHA256 6001f3feca2243b39550842e30b06ef760cfbcf1ea22f3f156451a950de2bca2
MD5 c0486344e7f93aab6803a072220a8795
SHA1 331134c924f9c549f68116c7d0566dbe5c0a57c7
SHA512 11ec7c51064defdb96558acc3355f5dbe2bb72a76423e2b64d674ea3f10cd94b02078733a95a5b99c616abeedd6bb1892fda7e4d89c0f07b1b41be72c9ea478e
SSDEEP 49152:ONEOdxOMlP98UajkM7nDGal4UDbTqMxtlDsaUc5i+jzeDYDK1+vgJM34:O9habd2AdxdsDOwM3
TLSH
T17CE5F103E35682E8C56B9538C6BA9F1BF7707840132497EB22E12E256F57AF01E7B351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

844304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\News\Berserk\Logit\x64\Release\Spectacle.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dxgi

CreateDXGIFactory

kernel32

CheckRemoteDebuggerPresent GetModuleHandleW GetSystemTimeAsFileTime SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA CreateFileMappingA UnmapViewOfFile LocalFree HeapFree HeapAlloc ReadFile GetFileSizeEx GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive IsDebuggerPresent SleepConditionVariableSRW GetCurrentThreadId GetTickCount GetLocalTime Process32FirstW Process32NextW GetFileAttributesA GetTempPathA Sleep CreateToolhelp32Snapshot OpenProcess FindClose GetEnvironmentVariableA TerminateProcess GetCurrentProcess FindFirstFileA CloseHandle CreateFileA GetLastError QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetComputerNameA WideCharToMultiByte CreateProcessA MultiByteToWideChar CreateFile2 GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable AreFileApisANSI MapViewOfFile InitializeSListHead

user32

TranslateMessage PostQuitMessage SetWindowLongA UpdateWindow GetDC GetMessageExtraInfo GetSystemMetrics MoveWindow GetWindowRect SetClipboardData GetClipboardData PeekMessageW ReleaseDC GetKeyState GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen ScreenToClient GetCapture SetLayeredWindowAttributes

gdi32

SetStretchBltMode BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject

advapi32

GetUserNameA CryptHashData CryptReleaseContext CryptGetHashParam CryptCreateHash RegQueryValueExA RegOpenKeyExA GetCurrentHwProfileA RegEnumValueA CryptAcquireContextA RegCloseKey CryptDestroyHash

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoCreateInstance CoCreateGuid

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?good@ios_base@std@@QEBA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Mtx_unlock ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Query_perf_counter _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z _Cnd_do_broadcast_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Thrd_detach ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

winhttp

WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

crypt32

CryptUnprotectData CryptStringToBinaryA CryptBinaryToStringA CryptProtectData

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA InternetWriteFile InternetReadFile

ws2_32

gethostbyname WSACleanup socket connect htons recv send closesocket WSAStartup

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr strchr wcsstr strrchr longjmp memcpy memmove __std_terminate memchr memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memset __std_exception_destroy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function system _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback abort _errno terminate _beginthreadex _crt_atexit exit _initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

_atoi64 strtoul strtol

api-ms-win-crt-stdio-l1-1-0

fgetc __p__commode __stdio_common_vsprintf_s _set_fmode __acrt_iob_func fflush fclose fseek _get_stream_buffer_pointers _fseeki64 fsetpos ungetc __stdio_common_vfprintf setvbuf fgetpos fwrite ftell _wfopen fputc __stdio_common_vsprintf fread __stdio_common_vsscanf

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64

api-ms-win-crt-math-l1-1-0

sinf acosf fmodf ceilf sqrtf cosf powf roundf __setusermatherr

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s _wcslwr_s wcslen wcsncpy_s strncpy strcmp strncmp strlen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale