opener[.]exe | Triage™

General

Target
opener.exe
Size 399KB
Sample260807-yc2djsvxgt
SHA256 92b29ad7ebea1915ab39c6649719afc7fb7ea31a31bdc2728ff741bef2d5096c
MD5 0b40e469c6051d3b4416c3a82bbadade
SHA1 75d010465e3605f2045d92b525203f35137348f8
SHA512 fb92614a425fad720e85e3013abdd4d69b9b19a509ceb7230ac429374779317b03e328dc671062bb78b760c40b0e9a5c115e6709289f435000b1d6545a174c7a
SSDEEP 6144:ptKbCEfbMyY2VYjKS55/rQWvV3wvdruoY1GROi/GcAe:zKbCAVYjeWvV3wRR1ucAe
TLSH
T118945C117991D032D97708768DFACB799E3DFC810B6169DBA3C40FAE4E206D1BB3061A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
opener.exe

File Explorer

opener.exe

.exe 399KB

opener.exe

IMPHASH bc13cda66109a89020fb244e6379b1e3
SHA256 92b29ad7ebea1915ab39c6649719afc7fb7ea31a31bdc2728ff741bef2d5096c
MD5 0b40e469c6051d3b4416c3a82bbadade
SHA1 75d010465e3605f2045d92b525203f35137348f8
SHA512 fb92614a425fad720e85e3013abdd4d69b9b19a509ceb7230ac429374779317b03e328dc671062bb78b760c40b0e9a5c115e6709289f435000b1d6545a174c7a
SSDEEP 6144:ptKbCEfbMyY2VYjKS55/rQWvV3wvdruoY1GROi/GcAe:zKbCAVYjeWvV3wRR1ucAe
TLSH
T118945C117991D032D97708768DFACB799E3DFC810B6169DBA3C40FAE4E206D1BB3061A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteA

advapi32

RegSetValueExA RegCloseKey RegOpenKeyExA

kernel32

WriteConsoleW FreeLibrary GetEnvironmentVariableA CreateDirectoryA GetFileAttributesA SetFileAttributesA CreateProcessA GetModuleFileNameA LoadResource LockResource SizeofResource FindResourceA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetEndOfFile GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap CreateFileW

Name

.text

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

opener.exe

shell32

advapi32

kernel32

generic