Huroof[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Huroof.exe
Size 66.9MB
Sample260808-29p9bsem9y
SHA256 3d804ff4a0801907f2228ac4ca726c30d548209d01fb167bb0717cbd2daa38b8
MD5 d9feb3496ad4cebbbb06f8d2118ae509
SHA1 81210b5aeb044fe76f13158f91258128fa9a3012
SHA512 687c5cdcb7fcd063021d91b942ca480ba4e9b45145a4a94fb121b93658d3b1596c738e8c8f01e45d66e6b04b83bc7b400feb12eab9015c7f5941980f9474c493
SSDEEP 1572864:QGW1Zk8qwBAEScRHxBEfnvZtL824hLuJ+/jrOwtTJ:P7UAEXvBEnZG2Mo6j/V
TLSH
T1F8E733D17BD68473D1B64A71223CE67B80A67C5D6E36808F6394331E6F31982993AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Huroof.exe

File Explorer

Huroof.exe

.exe 66.9MB

Huroof.exe

IMPHASH 5cbbb120d28c4ecdbf613834da9ae411
SHA256 3d804ff4a0801907f2228ac4ca726c30d548209d01fb167bb0717cbd2daa38b8
MD5 d9feb3496ad4cebbbb06f8d2118ae509
SHA1 81210b5aeb044fe76f13158f91258128fa9a3012
SHA512 687c5cdcb7fcd063021d91b942ca480ba4e9b45145a4a94fb121b93658d3b1596c738e8c8f01e45d66e6b04b83bc7b400feb12eab9015c7f5941980f9474c493
SSDEEP 1572864:QGW1Zk8qwBAEScRHxBEfnvZtL824hLuJ+/jrOwtTJ:P7UAEXvBEnZG2Mo6j/V
TLSH
T1F8E733D17BD68473D1B64A71223CE67B80A67C5D6E36808F6394331E6F31982993AF13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

825020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Branch\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateDirectoryW GetCurrentProcessId GetExitCodeThread SetEvent CreateEventW SetLastError LoadLibraryW FreeLibrary lstrlenW GetVersionExW CreateFileA SetStdHandle WriteConsoleW WriteConsoleA GetModuleHandleA InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetConsoleMode GetConsoleCP GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW GetDiskFreeSpaceExW IsValidCodePage GetOEMCP GetACP HeapCreate LCMapStringW LCMapStringA GetCPInfo RtlUnwind ExitProcess lstrcmpiW TlsSetValue TlsAlloc TlsGetValue LoadLibraryA GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange PeekNamedPipe OpenEventW SearchPathW ResetEvent MoveFileW GetLocaleInfoA GetStringTypeW ConnectNamedPipe CreateNamedPipeW TerminateThread GetSystemDirectoryW GetLocalTime OutputDebugStringW GetVersion Process32NextW Process32FirstW CreateToolhelp32Snapshot GetWindowsDirectoryW GetUserDefaultLangID GetSystemDefaultLangID GetLocaleInfoW GetDriveTypeW CompareStringW InterlockedDecrement InterlockedIncrement GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc lstrcmpW GetFileSize ReadFile GlobalFree GetTempPathW GetSystemTime GetTempFileNameW DeleteFileW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileAttributesW SetFileAttributesW CopyFileW FindClose MultiByteToWideChar LoadLibraryExW WideCharToMultiByte InterlockedExchange GetSystemInfo TlsFree WaitForMultipleObjects Sleep GetLastError GetCurrentThreadId WaitForSingleObject MulDiv lstrcpynW FindResourceExW FindResourceW LoadResource LockResource SizeofResource EnumResourceLanguagesW SetEndOfFile SetCurrentDirectoryW GetCommandLineW UnlockFile LockFile GetExitCodeProcess CreateProcessW DuplicateHandle GetModuleFileNameA FlushFileBuffers SetFilePointer GetConsoleOutputCP LeaveCriticalSection GetConsoleScreenBufferInfo GetStdHandle SetConsoleTextAttribute GetFullPathNameW GetCurrentThread GetEnvironmentVariableW InitializeCriticalSection EnterCriticalSection DeleteCriticalSection GetModuleHandleW GetProcAddress RaiseException FlushInstructionCache GetCurrentProcess CloseHandle WriteFile CreateFileW FreeEnvironmentStringsW GetStartupInfoW GetShortPathNameW LocalAlloc FormatMessageW CreateThread SetUnhandledExceptionFilter LocalFree

user32

MapWindowPoints GetParent DefWindowProcW SendMessageW GetWindowTextW GetWindowTextLengthW FillRect IsWindow ShowWindow GetClientRect UnionRect IsWindowVisible BeginPaint EndPaint ScreenToClient SetWindowPos GetWindowDC LookupIconIdFromDirectoryEx GetWindowLongW GetWindowRect CallWindowProcW SetWindowLongW GetWindow DrawFrameControl RegisterWindowMessageW InvalidateRgn GetDesktopWindow GetKeyState DrawStateW DrawTextExW DrawFocusRect ValidateRect DestroyMenu AppendMenuW CreatePopupMenu TrackPopupMenu InflateRect LoadBitmapW MessageBeep LoadImageW CharNextW GetClassNameW ReleaseCapture SetCapture UpdateWindow DestroyIcon GetDlgCtrlID GetCapture SetScrollInfo GetScrollPos GetClassInfoExW RegisterClassExW DrawEdge SetScrollPos SetRect MoveWindow GetScrollInfo GetMessagePos SystemParametersInfoW GetActiveWindow TrackMouseEvent GetAsyncKeyState DestroyCursor GetWindowRgn IsZoomed SetWindowRgn GetComboBoxInfo DestroyAcceleratorTable CreateAcceleratorTableW TranslateAcceleratorW CreateDialogParamW EndDialog DialogBoxParamW InvalidateRect GetNextDlgTabItem SetCursor MonitorFromWindow GetMonitorInfoW IsDialogMessageW IsChild PostQuitMessage PostMessageW SetForegroundWindow SetCursorPos GetCursorPos PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadCursorW LoadStringW MessageBoxW GetFocus EnableWindow DestroyWindow GetForegroundWindow EnumWindows GetWindowThreadProcessId DialogBoxIndirectParamW MsgWaitForMultipleObjects GetPropW GetSystemMenu EnableMenuItem ModifyMenuW FindWindowW ExitWindowsEx GetScrollRange SetPropW RemovePropW LoadMenuW GetSubMenu OpenClipboard CloseClipboard EmptyClipboard SetClipboardData GetIconInfo SendMessageTimeoutW UnregisterClassA DrawTextW DrawIconEx GetSystemMetrics ClientToScreen OffsetRect SetRectEmpty PtInRect GetSysColorBrush IntersectRect IsRectEmpty SendMessageA IsWindowEnabled CopyRect RedrawWindow SetFocus GetSysColor CreateWindowExW GetDlgItem SetWindowTextW EqualRect SetTimer KillTimer GetDC ReleaseDC CreateIconFromResourceEx

gdi32

GetLayout GetBrushOrgEx CreateFontIndirectW CreateSolidBrush GetRgnBox EqualRgn CreatePolygonRgn CreateRectRgnIndirect GetStockObject CreateFontW SetBkMode SetTextColor SetBrushOrgEx CreatePatternBrush FillRgn SelectClipRgn GetBitmapBits CreateRectRgn GetObjectW GetDeviceCaps Rectangle ExcludeClipRect CreatePen ExtTextOutW SetBkColor BitBlt SetViewportOrgEx CreateCompatibleBitmap CreateCompatibleDC DeleteObject SelectObject DeleteDC CreateDIBSection CreateBitmapIndirect CombineRgn

advapi32

RegOpenKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW StartServiceW QueryServiceStatus OpenServiceW RegDeleteValueA RegQueryValueExA RegOpenKeyA RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExA OpenSCManagerW LockServiceDatabase UnlockServiceDatabase CloseServiceHandle RegOpenKeyExA RegEnumValueA LookupAccountSidW RegCreateKeyW OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid GetUserNameW RegDeleteKeyA RegCreateKeyA

shell32

ShellExecuteW SHGetFileInfoW SHGetFolderPathW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetSpecialFolderLocation ShellExecuteExW

ole32

CoTaskMemRealloc CoTaskMemFree CoInitialize OleInitialize CLSIDFromString CoGetClassObject CoCreateInstance CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CoUninitialize CoCreateGuid CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoInitializeEx CLSIDFromProgID

oleaut32

VarUI4FromStr VarDateFromStr OleLoadPicture SysStringByteLen SysAllocStringByteLen SysAllocStringLen LoadTypeLi LoadRegTypeLi SysStringLen OleCreateFontIndirect VariantCopy VariantInit VariantClear SysAllocString SysFreeString

dbghelp

SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions SymFunctionTableAccess StackWalk SymGetModuleBase

shlwapi

PathAddBackslashW PathFileExistsW PathIsUNCW PathIsDirectoryW

comctl32

ImageList_Create PropertySheetW DestroyPropertySheetPage InitCommonControlsEx ImageList_LoadImageW ImageList_GetIcon ImageList_AddMasked ImageList_SetBkColor _TrackMouseEvent ImageList_Add ImageList_ReplaceIcon ImageList_Destroy CreatePropertySheetPageW

msimg32

TransparentBlt AlphaBlend

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetUserGetLocalGroups NetApiBufferFree NetLocalGroupGetMembers

secur32

GetUserNameExW

comdlg32

GetOpenFileNameW GetSaveFileNameW