gs-autopsy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gs-autopsy.exe
Size 2.5MB
Sample260807-rl5c8sfl8t
SHA256 28a62b0135f98b1fffaa52a990b95082036880fe8ac7fa5833ccbd829c31a2a4
MD5 20e90e1c2e3fe0705d4eb37db942d703
SHA1 fc0d766f7022757646f305750d74cf04816d9971
SHA512 0280ed1f7465ebd7324ff122d13cb668e3560077a95b815c847a42313648410679e26f26096027240520b3e94c53214a37109f3df065f50717de823a43121245
SSDEEP 24576:/oWaK0GH2hd9bHozOLOxLEqZIeJqzMKLQ0tI67puYlSrJC8z0i/nWZeIHtZn9aFe:/olGWINYqZIeEwe7zlSfzB/nIW6l
TLSH
T120C5B5B1F31101EEC917ADBE450F4FAF5AF236A30E2C49C7B1E4E5A4A5721908764DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gs-autopsy.exe

File Explorer

gs-autopsy.exe

.exe 2.5MB

gs-autopsy.exe

IMPHASH 6ea65696dc50d5fd633719930895be0e
SHA256 28a62b0135f98b1fffaa52a990b95082036880fe8ac7fa5833ccbd829c31a2a4
MD5 20e90e1c2e3fe0705d4eb37db942d703
SHA1 fc0d766f7022757646f305750d74cf04816d9971
SHA512 0280ed1f7465ebd7324ff122d13cb668e3560077a95b815c847a42313648410679e26f26096027240520b3e94c53214a37109f3df065f50717de823a43121245
SSDEEP 24576:/oWaK0GH2hd9bHozOLOxLEqZIeJqzMKLQ0tI67puYlSrJC8z0i/nWZeIHtZn9aFe:/olGWINYqZIeEwe7zlSfzB/nIW6l
TLSH
T120C5B5B1F31101EEC917ADBE450F4FAF5AF236A30E2C49C7B1E4E5A4A5721908764DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1081036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

?_Xbad_alloc@std@@YAXXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

gdi32

GetDeviceCaps

dwmapi

DwmExtendFrameIntoClientArea

user32

GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC MonitorFromPoint GetWindowThreadProcessId SetWindowLongA MessageBoxA GetWindowRect SetForegroundWindow UpdateWindow GetSystemMetrics BringWindowToTop IsIconic SetWindowDisplayAffinity SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA AttachThreadInput PeekMessageA DispatchMessageA TranslateMessage MapVirtualKeyA IsWindow FindWindowA SendInput GetClientRect EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetAsyncKeyState

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentProcess TerminateProcess AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree ReadFile GetFileSizeEx CreateFileA GetConsoleWindow GetModuleFileNameA CreateProcessA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot VirtualAllocEx OpenProcess GetProcessId CloseHandle WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetLocalTime GetCurrentThreadId ExitProcess GetFileAttributesA GetEnvironmentVariableA SetThreadPriority GetCurrentThread GetTickCount64 Sleep SetConsoleMode GetConsoleMode GetStdHandle WideCharToMultiByte IsProcessorFeaturePresent SleepConditionVariableSRW HeapAlloc GlobalFree GlobalLock GlobalUnlock InitializeSListHead GetSystemTimeAsFileTime GlobalAlloc GetLocaleInfoA MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask GetCurrentProcessId IsDebuggerPresent

shell32

ShellExecuteW

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

winmm

timeBeginPeriod

vcruntime140

__std_terminate memset __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler longjmp strrchr memcmp strchr memchr strstr __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _cexit abort _crt_atexit _configure_narrow_argv _register_thread_local_exe_atexit_callback _invoke_watson terminate __p___argv __p___argc _beginthreadex _initialize_onexit_table _register_onexit_function _exit exit _initialize_narrow_environment _errno _initterm_e _initterm _get_initial_narrow_environment _c_exit

api-ms-win-crt-string-l1-1-0

strcmp strncmp strncpy _stricmp strlen wcslen strncpy_s strcpy_s isdigit tolower

api-ms-win-crt-math-l1-1-0

fmodf roundf __setusermatherr _fdclass pow logf log atan2f sqrtf ceilf acosf sinf expf powf floorf cosf nearbyint

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

fgetpos fputc fsetpos _fseeki64 setvbuf ungetc _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf_s fgetc __stdio_common_vsscanf __stdio_common_vsprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func __p__commode _get_stream_buffer_pointers

api-ms-win-crt-convert-l1-1-0

strtol strtof atof

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale