Soda[.]lol[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Soda.lol.exe
Size 8.3MB
Sample260808-pr8azade58
SHA256 c09c3113d91ac9c2439b6cbb20a5d1442cd1b943e24c139666250bf97b6ceedc
MD5 32bb80a0c363d6c370575483f97fd52a
SHA1 1a0a241c17edfa2b999a8cfcfda97e828d7997ed
SHA512 d87aecf563a983515861237dff29580a9d91c872f6e37dc26e6b8d125fae924b6769205048ae9c38ff688aad28483d87fd8148042d6d591861746236c761cf5b
SSDEEP 98304:/QuFIxgxYQHR1E+UoupDkawnTufgEUZ4f:/QuFIxgxYQHR1bUoupDkjhe
TLSH
T1EE96D5257B5B996CD09BC47482478A62092130DB0B39B9FF4498963C2F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Soda.lol.exe

File Explorer

Soda.lol.exe

.exe 8.3MB

Soda.lol.exe

IMPHASH 4da3327bcd4a0aa22ce2d516fcd798ef
SHA256 c09c3113d91ac9c2439b6cbb20a5d1442cd1b943e24c139666250bf97b6ceedc
MD5 32bb80a0c363d6c370575483f97fd52a
SHA1 1a0a241c17edfa2b999a8cfcfda97e828d7997ed
SHA512 d87aecf563a983515861237dff29580a9d91c872f6e37dc26e6b8d125fae924b6769205048ae9c38ff688aad28483d87fd8148042d6d591861746236c761cf5b
SSDEEP 98304:/QuFIxgxYQHR1E+UoupDkawnTufgEUZ4f:/QuFIxgxYQHR1bUoupDkjhe
TLSH
T1EE96D5257B5B996CD09BC47482478A62092130DB0B39B9FF4498963C2F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5974912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Soda_lol.pdb

bcryptprimitives

ProcessPrng

advapi32

EventUnregister EventRegister EventWriteTransfer EventSetInformation RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError RtlGetVersion NtOpenFile NtWriteFile NtReadFile

kernel32

RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime CloseHandle GetProcAddress Sleep GetModuleHandleA RtlPcToFileHeader RaiseException GetModuleHandleW FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler FlsAlloc FlsGetValue CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetLastError LoadLibraryExW FreeLibrary GetFileInformationByHandle GetConsoleMode FlsSetValue FlsFree GetStdHandle GetEnvironmentStringsW EncodePointer GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind GetCurrentThreadId RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionEx WaitForSingleObjectEx CreateFileW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId SetHandleInformation CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime DeleteCriticalSection GetFullPathNameW lstrlenW SetFileInformationByHandle SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetUserDefaultUILanguage LCIDToLocaleName FormatMessageW HeapAlloc LoadLibraryExA

user32

DestroyIcon DispatchMessageA RegisterClassExW IsProcessDPIAware GetDC ReleaseDC RegisterWindowMessageA GetWindow SetPropW SetParent EnumChildWindows IsWindowEnabled RegisterTouchWindow CloseTouchInputHandle GetTouchInputInfo MapWindowPoints EnableWindow SystemParametersInfoA ReleaseCapture GetMessageA GetRawInputData SetFocus ShowWindow SetCapture SetWindowRgn VkKeyScanW DrawTextW GetWindowDC OffsetRect GetWindowRect DestroyMenu TrackPopupMenu SetWindowDisplayAffinity RegisterRawInputDevices PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout MsgWaitForMultipleObjectsEx ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SetWindowLongW EnableMenuItem GetSystemMenu SendInput SetForegroundWindow EnumDisplayMonitors SetWindowLongPtrW GetMenu ShowCursor DestroyWindow ClipCursor GetClipCursor IsWindowVisible TranslateAcceleratorW GetParent GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MonitorFromPoint DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW SetWindowTextW IsWindow CreateWindowExW GetWindowTextW AdjustWindowRectEx GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos GetWindowLongPtrW SetCursor TrackMouseEvent SystemParametersInfoW GetWindowTextLengthW FillRect GetMenuBarInfo GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient LoadCursorW PostMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect IsIconic SendMessageW RedrawWindow AdjustWindowRect FindWindowExW

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

gdi32

SelectObject DeleteObject CreateRectRgn GetDeviceCaps BitBlt CreateCompatibleDC DeleteDC CreateDIBSection CreateSolidBrush SetBkMode CombineRgn SetTextColor

ole32

RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance CoInitializeEx CoCreateFreeThreadedMarshaler CoUninitialize

shlwapi

SHCreateMemStream

shell32

ShellExecuteW SHGetKnownFolderPath DragFinish DragQueryFileW SHAppBarMessage

combase

CoTaskMemFree CoTaskMemAlloc

ws2_32

WSAStartup WSACleanup closesocket getaddrinfo freeaddrinfo connect send WSAGetLastError WSASocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

pow roundf floor __setusermatherr round trunc

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

__p___argv _exit exit _initterm_e _initterm _cexit _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate abort __p___argc _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc malloc free