trueware[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
trueware.exe
Size 10.3MB
Sample260809-xkh2hatfrb
SHA256 dcb59cc5b1595ac486d6f95348858861cb6c828641463857c283b07aed98816f
MD5 cd504e369d277245e6ecb9a007b047b4
SHA1 39cd23b414c2ea4f0f382176c284c894cfd607cb
SHA512 6c9243de853b3c081ab1ba1789c0efc297f1aa148e7ddd24a8787136a8436f5e2bfe40a3ee49e0ec475db77b80e879290e0f29d9f7e51184a84bc31ab4ba6c77
SSDEEP 49152:pJmjW4Q4i1UoKYIQmpP0ZEuTpZ9zZk+cKrtBnKL:uNQ8/UZZpMst
TLSH
T1F1B622E4F1262BA4A837FD75641D7579439A5900FB39E0368CFEEF2221B4DB408253A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trueware.exe

File Explorer

trueware.exe

.exe 10.3MB

trueware.exe

IMPHASH cc8c856c08a1eeede803fc35745ff8f7
SHA256 dcb59cc5b1595ac486d6f95348858861cb6c828641463857c283b07aed98816f
MD5 cd504e369d277245e6ecb9a007b047b4
SHA1 39cd23b414c2ea4f0f382176c284c894cfd607cb
SHA512 6c9243de853b3c081ab1ba1789c0efc297f1aa148e7ddd24a8787136a8436f5e2bfe40a3ee49e0ec475db77b80e879290e0f29d9f7e51184a84bc31ab4ba6c77
SSDEEP 49152:pJmjW4Q4i1UoKYIQmpP0ZEuTpZ9zZk+cKrtBnKL:uNQ8/UZZpMst
TLSH
T1F1B622E4F1262BA4A837FD75641D7579439A5900FB39E0368CFEEF2221B4DB408253A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1341476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jrnoa\Downloads\fragment\fragment\fragment\build\trueware.pdb

kernel32

WideCharToMultiByte GlobalUnlock GetTickCount64 WriteProcessMemory LoadLibraryW GetModuleHandleW OutputDebugStringA GetWindowsDirectoryA GetConsoleWindow GetModuleFileNameA Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot GetLastError Process32Next CloseHandle GetExitCodeProcess SetConsoleScreenBufferSize GetStdHandle SetCurrentConsoleFontEx SetConsoleWindowInfo GetConsoleScreenBufferInfo SetConsoleTextAttribute GetLocalTime CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GlobalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent GlobalAlloc GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFinalPathNameByHandleW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency GlobalLock LoadLibraryA MultiByteToWideChar GetLocaleInfoA TerminateProcess GetModuleHandleA

user32

GetWindowThreadProcessId PostMessageA DefWindowProcW MonitorFromPoint DispatchMessageA IsWindowVisible GetWindow EnumWindows DestroyWindow SetWindowPos GetSystemMetrics GetClassNameA ShowWindow SetWindowLongA SetWindowDisplayAffinity CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA UnregisterClassA PostQuitMessage FindWindowA RegisterClassExA UpdateWindow IsWindow GetAsyncKeyState SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode GetCursorPos ReleaseDC SetCursorPos ReleaseCapture

gdi32

GetDeviceCaps CreateSolidBrush

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Thrd_detach ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Cnd_broadcast ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??7ios_base@std@@QEBA_NXZ

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

urlmon

URLDownloadToFileA

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr memmove __std_exception_destroy __std_exception_copy _purecall __C_specific_handler _CxxThrowException __intrinsic_setjmp __std_terminate strrchr longjmp __current_exception_context __current_exception memcpy memset memcmp memchr strstr

api-ms-win-crt-stdio-l1-1-0

ftell __acrt_iob_func fflush _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _fwrite_nolock fgetc fputc __p__commode fclose fseek __stdio_common_vfprintf fwrite _wfopen __stdio_common_vsprintf _set_fmode __stdio_common_vsscanf fread

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

wcscpy_s strncpy isdigit tolower strcmp strncmp toupper _stricmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh calloc malloc free

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _beginthreadex terminate abort system _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

atof strtol strtoull

api-ms-win-crt-math-l1-1-0

round lroundf __setusermatherr atan2f ceilf _fdsign expf fmodf logf pow powf roundf _dsign sqrtf sinf _ldclass _ldsign _fdclass cosf acosf _dclass

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale