testsix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
testsix.exe
Size 307KB
Sample260807-pcvrbsvdqb
SHA256 f0f2d214e870ac2a125614c0a5f9667f5febf54d0e88defb059123615c6c5063
MD5 28ff384546d824f213b7830df368c3b4
SHA1 e95087af0adb6c9c432f381388ad1029d2b14669
SHA512 4dcb63968c505a198924679127687a677bc7fd9f41b229ba2392c783cabc9ac2893dabe1836759196ccd53ee672265d03daf635553bfddd44739144636a42268
SSDEEP 6144:BqYNym1LRFo6PuUtE6FwEEF1gtmYADOaAim9:o+W6tE6F3EF1ttiau9
TLSH
T1BE646C15F7A410F9EAABC57CC9524506EA72BC460771EBCF03A08A963F236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
testsix.exe

File Explorer

testsix.exe

.exe 307KB

testsix.exe

IMPHASH fa2510509d83360b4d95e60be3cdb04e
SHA256 f0f2d214e870ac2a125614c0a5f9667f5febf54d0e88defb059123615c6c5063
MD5 28ff384546d824f213b7830df368c3b4
SHA1 e95087af0adb6c9c432f381388ad1029d2b14669
SHA512 4dcb63968c505a198924679127687a677bc7fd9f41b229ba2392c783cabc9ac2893dabe1836759196ccd53ee672265d03daf635553bfddd44739144636a42268
SSDEEP 6144:BqYNym1LRFo6PuUtE6FwEEF1gtmYADOaAim9:o+W6tE6F3EF1ttiau9
TLSH
T1BE646C15F7A410F9EAABC57CC9524506EA72BC460771EBCF03A08A963F236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\PC\source\repos\TekilGta\x64\Release\TekilGta.pdb

kernel32

WaitForSingleObject MultiByteToWideChar Sleep GetTempPathA CloseHandle GetLocalTime CreateProcessA SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetSystemPowerStatus HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetEnvironmentStringsW ExpandEnvironmentStringsA LoadLibraryExW VirtualProtect GetConsoleMode GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapFree HeapAlloc FlushFileBuffers GetConsoleOutputCP RtlUnwind

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear SafeArrayCreate SafeArrayPutElement SysAllocString SysFreeString VariantInit

winhttp

WinHttpSetOption WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpReadData

iphlpapi

GetIfTable

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

Name

.text

Size

204KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

testsix.exe

kernel32

ole32

oleaut32

winhttp

iphlpapi

setupapi

generic