Grape[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Grape.exe
Size 546KB
Sample260809-3pqj2axdpf
SHA256 9cb44d75a407b7cc56546ca559c2228838bb82c6c03fcd9435fbf35999262dd5
MD5 a25f33243e4566e80377c400c8d9f3fc
SHA1 c833a6bb86a19d2631e9c757e51bc7ccce2627b5
SHA512 cdd4cf9a5453fe87b85852c348d345de774e73b5690b9ab27181d30329dbe5b0746ea3c4a162e4c5e63d272a96a1e86e882f023e3459cf1fdd8867ad205108f3
SSDEEP 6144:w5oll4PNG7VOFphcenXTn/GbkNCgd3c2EnTUv7ZMIqReAWUFEkiRYHEzwef5nChM:w56J8nvfyTIifWFkiRYkzwef5nY
TLSH
T1D9C49D95B2E403F8E0778038C465A62BF675785407309ADB13E446796FB37E18EBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Grape.exe

File Explorer

Grape.exe

.exe 546KB

Grape.exe

IMPHASH 457be5a815393ad5f7fa77ceefa417ad
SHA256 9cb44d75a407b7cc56546ca559c2228838bb82c6c03fcd9435fbf35999262dd5
MD5 a25f33243e4566e80377c400c8d9f3fc
SHA1 c833a6bb86a19d2631e9c757e51bc7ccce2627b5
SHA512 cdd4cf9a5453fe87b85852c348d345de774e73b5690b9ab27181d30329dbe5b0746ea3c4a162e4c5e63d272a96a1e86e882f023e3459cf1fdd8867ad205108f3
SSDEEP 6144:w5oll4PNG7VOFphcenXTn/GbkNCgd3c2EnTUv7ZMIqReAWUFEkiRYHEzwef5nChM:w56J8nvfyTIifWFkiRYkzwef5nY
TLSH
T1D9C49D95B2E403F8E0778038C465A62BF675785407309ADB13E446796FB37E18EBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

Major OS version

Entry point

229836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter SetLastError SetConsoleTitleA WaitForSingleObject MultiByteToWideChar GetLastError CreateThread WideCharToMultiByte IsDebuggerPresent GetExitCodeProcess HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP CreateFileW FindNextFileW FindFirstFileExW FindClose OutputDebugStringW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileAttributesExW CreateProcessW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile FreeLibraryAndExitThread DeviceIoControl SetEndOfFile IsValidCodePage ExitThread WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile

user32

EmptyClipboard CloseClipboard SetClipboardData TranslateMessage OpenClipboard GetWindowLongW GetWindowThreadProcessId DefWindowProcW GetWindow GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetForegroundWindow MoveWindow EnumWindows CreateWindowExA SetLayeredWindowAttributes GetCursorPos SetWindowLongW PostQuitMessage UpdateWindow SendInput GetKeyState ScreenToClient GetActiveWindow GetCapture ClientToScreen LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetClipboardData

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3d9

Direct3DCreate9Ex

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

Name

.text

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Grape.exe

dwmapi

kernel32

user32

imm32

d3d9

ntdll

generic