ticket_autocollect[.]exe

General

Target
ticket_autocollect.exe
Size 145KB
Sample260811-b9k2hashlc
SHA256 3b7b1e2a9e2b401243e58c4c5342a55172e49796262f82db47ceb92c3554df3c
MD5 7123d82db243ddad51e87aaa501640e5
SHA1 a630d9554889637ec9b1238a72c0a8df8cbc5576
SHA512 27b180a9a3d7da01ca90405479748534cfd36555e6de3dfe8bed30a6ea20e3bf54c4139d7ec75f402736c7259754373699845f79267714c19eb812995ee15ab2
SSDEEP 3072:kf8BNytq6ZWsWG85KcXJr8LIhnYf0j6ATKI7Kp:kf8BD6Zp1zyOIhYfETo
TLSH
T1B8E35B57B2A530FDE077C135C8910A46E7B6B8760761ABDF03A4827A2F176E09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ticket_autocollect.exe

File Explorer

ticket_autocollect.exe

.exe 145KB

ticket_autocollect.exe

IMPHASH ea5d615730e339ae505e9c514a918aa6
SHA256 3b7b1e2a9e2b401243e58c4c5342a55172e49796262f82db47ceb92c3554df3c
MD5 7123d82db243ddad51e87aaa501640e5
SHA1 a630d9554889637ec9b1238a72c0a8df8cbc5576
SHA512 27b180a9a3d7da01ca90405479748534cfd36555e6de3dfe8bed30a6ea20e3bf54c4139d7ec75f402736c7259754373699845f79267714c19eb812995ee15ab2
SSDEEP 3072:kf8BNytq6ZWsWG85KcXJr8LIhnYf0j6ATKI7Kp:kf8BD6Zp1zyOIhYfETo
TLSH
T1B8E35B57B2A530FDE077C135C8910A46E7B6B8760761ABDF03A4827A2F176E09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetAsyncKeyState

kernel32

WriteConsoleW CloseHandle WaitForSingleObject OpenProcess GetModuleHandleA GetProcAddress WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleBaseNameA CreateFileW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetLastError WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ticket_autocollect.exe

user32

kernel32

generic