xd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xd.exe
Size 10.0MB
Sample260809-yahtesvbjg
SHA256 6c9cad4e937947fa9de9c560423e7a20fd12439c6ea8ae96825fd1d9d28867a4
MD5 e62664bcdcc25dc68802556ecc818d0e
SHA1 3219699dfe91035029786006642c3a2bf29e6054
SHA512 71c11a5c46d6513719347f2662f29202408d3e979734228515147c1d2e3dc9e5c16b9198c7ac9bc74846c631e9e4b391dceae020e249892d7e8cfc9fb662a68b
SSDEEP 49152:XEo8JbrnOU3MRldcufSAiJEl5dqxIfIJexhS+gCKdeIc5mzNzKJ2G:X9excCAfvSGhiPwENzKr
TLSH
T150B6D6704BACE1BED7098463FB03DE293F26AA07E21F6D7A555837402A5F39B1925703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xd.exe

File Explorer

xd.exe

.exe 10.0MB

xd.exe

IMPHASH a3fcb18c96d1998d1a1888c0f539a353
SHA256 6c9cad4e937947fa9de9c560423e7a20fd12439c6ea8ae96825fd1d9d28867a4
MD5 e62664bcdcc25dc68802556ecc818d0e
SHA1 3219699dfe91035029786006642c3a2bf29e6054
SHA512 71c11a5c46d6513719347f2662f29202408d3e979734228515147c1d2e3dc9e5c16b9198c7ac9bc74846c631e9e4b391dceae020e249892d7e8cfc9fb662a68b
SSDEEP 49152:XEo8JbrnOU3MRldcufSAiJEl5dqxIfIJexhS+gCKdeIc5mzNzKJ2G:X9excCAfvSGhiPwENzKr
TLSH
T150B6D6704BACE1BED7098463FB03DE293F26AA07E21F6D7A555837402A5F39B1925703
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

607776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Aqua\x64\Release\Aqua.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetOption WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpReadData

ws2_32

WSAStartup WSAGetLastError setsockopt htons htonl inet_pton listen closesocket bind recv accept socket connect send

secur32

FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW AcceptSecurityContext DecryptMessage InitializeSecurityContextW EncryptMessage FreeContextBuffer DeleteSecurityContext

bcrypt

BCryptEncrypt BCryptGenRandom BCryptDestroyKey BCryptGetProperty BCryptFinalizeKeyPair BCryptDecrypt BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptExportKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty

crypt32

CertFindCertificateInStore CryptDecodeObjectEx CertCreateSelfSignCertificate CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA PFXExportCertStore CertCloseStore CertStrToNameA CertOpenStore PFXImportCertStore CryptImportPublicKeyInfoEx2

advapi32

CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext GetUserNameA

kernel32

GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot OpenProcess CreateFileW WaitForSingleObject CreateMutexA GetStartupInfoW CreateNamedPipeW GetModuleFileNameW TerminateProcess Process32NextW OutputDebugStringA WriteFile FindNextFileW FindFirstFileW SizeofResource GetModuleFileNameA ReadFile GetComputerNameA CheckRemoteDebuggerPresent IsDebuggerPresent CreateFileA LockResource Process32FirstW CloseHandle LoadResource FindResourceW CreateFileMappingA LocalFree CreateProcessW GetSystemTime SetConsoleTitleW ConnectNamedPipe SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable FlushFileBuffers GetExitCodeProcess GetCurrentThreadId DeviceIoControl GetCurrentProcessId AcquireSRWLockExclusive FindClose Beep InitializeSListHead GetSystemTimeAsFileTime MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetCurrentProcess ReleaseSRWLockExclusive GetModuleHandleW

user32

UpdateWindow GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen PostQuitMessage GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData TranslateMessage PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW DestroyWindow DefWindowProcW TrackMouseEvent

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmSetWindowAttribute

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Mtx_unlock _Query_perf_counter _Strcoll _Mtx_lock ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Strxfrm ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Xtime_get_ticks ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler _CxxThrowException __std_exception_copy memcmp memcpy memmove memset __current_exception_context strchr __std_exception_destroy strstr __std_terminate memchr __std_type_info_compare __RTtypeid wcsrchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __acrt_iob_func ftell fflush fgetpos setvbuf ungetc fsetpos _fseeki64 _get_stream_buffer_pointers fclose fseek _set_fmode __stdio_common_vswprintf_s fputc __stdio_common_vfprintf fgetc fwrite _wfopen __stdio_common_vsprintf fread __stdio_common_vsnwprintf_s __p__commode __stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free _callnewh realloc malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s wcscat_s wcscpy_s _wcsicmp isalnum tolower toupper strncpy strlen strcmp wcslen strncmp

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtoull strtoul

api-ms-win-crt-runtime-l1-1-0

_initterm _beginthreadex terminate _seh_filter_exe _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _cexit _c_exit _errno _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _exit exit _initterm_e _set_app_type

api-ms-win-crt-math-l1-1-0

sqrtf sinf fmodf __setusermatherr acosf _dsign ceilf cosf expf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_locale_name_func ___lc_collate_cp_func localeconv

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file