Soda_lol[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Soda_lol.exe
Size 8.3MB
Sample260812-lnnklstdqd
SHA256 0fc04f424076678bef9da96cf8a536a1f4f4a1465c0b7c4d5733176b602c647e
MD5 a3b4d82e8619095c6f8213a9be436c4c
SHA1 e7a4ce5b1fbe5a5d9b9f7139b495b36ae7b6b4ec
SHA512 5145fcfec3463425c29547a1dcdc00f1c616932f8ecf19f1772cc16dd8790505c7e96ad00eba004b65fd94acb12831f3742008008380d6fe114d6b79aca9a421
SSDEEP 98304:u3OcnCFSyOMgR/7/gtmeasbxfzLv6gLDwjf:u3OcnCFSyOMgR/7/gweVxLXk
TLSH
T1C396D5257B5B996CD09BC47482478A62492030DB0B39A9FF4498963C3F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Soda_lol.exe

File Explorer

Soda_lol.exe

.exe 8.3MB

Soda_lol.exe

IMPHASH 0051d03d13323b9a349798f8c9c88d4d
SHA256 0fc04f424076678bef9da96cf8a536a1f4f4a1465c0b7c4d5733176b602c647e
MD5 a3b4d82e8619095c6f8213a9be436c4c
SHA1 e7a4ce5b1fbe5a5d9b9f7139b495b36ae7b6b4ec
SHA512 5145fcfec3463425c29547a1dcdc00f1c616932f8ecf19f1772cc16dd8790505c7e96ad00eba004b65fd94acb12831f3742008008380d6fe114d6b79aca9a421
SSDEEP 98304:u3OcnCFSyOMgR/7/gtmeasbxfzLv6gLDwjf:u3OcnCFSyOMgR/7/gweVxLXk
TLSH
T1C396D5257B5B996CD09BC47482478A62492030DB0B39A9FF4498963C3F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5989456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Soda_lol.pdb

bcryptprimitives

ProcessPrng

advapi32

EventUnregister EventRegister EventWriteTransfer EventSetInformation RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW

ntdll

NtCreateNamedPipeFile NtReadFile NtWriteFile NtOpenFile RtlNtStatusToDosError RtlGetVersion

kernel32

RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime CloseHandle GetProcAddress Sleep GetModuleHandleA RaiseException GetModuleHandleW FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex FlsAlloc WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee FlsGetValue FlsSetValue AddVectoredExceptionHandler CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetLastError LoadLibraryExW FreeLibrary GetFileInformationByHandle GetConsoleMode FlsFree GetStdHandle GetEnvironmentStringsW GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CancelIo EncodePointer GetSystemTimePreciseAsFileTime RtlVirtualUnwind GetCurrentThreadId RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionEx CreateMutexA CreateFileW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId SetHandleInformation CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime DeleteCriticalSection GetFullPathNameW lstrlenW SetFileInformationByHandle SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetUserDefaultUILanguage LCIDToLocaleName FormatMessageW HeapAlloc LoadLibraryExA

user32

SetPropW GetMessageA ReleaseCapture IsProcessDPIAware GetDC ReleaseDC SetCapture DispatchMessageA SystemParametersInfoA RegisterClassExW RegisterRawInputDevices RegisterTouchWindow CloseTouchInputHandle GetTouchInputInfo EnumChildWindows SetWindowRgn GetRawInputData FindWindowExW RegisterWindowMessageA MsgWaitForMultipleObjectsEx GetWindow SetParent MapWindowPoints GetWindowLongPtrW SetWindowDisplayAffinity GetParent VkKeyScanW SetFocus GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu MonitorFromPoint EnumDisplayMonitors TrackPopupMenu PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW CreateIcon ShowWindow GetKeyboardLayout ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SetWindowLongW EnableMenuItem GetSystemMenu SendInput EnableWindow IsWindowEnabled SetForegroundWindow GetMenu DestroyWindow ShowCursor ClipCursor GetClipCursor TranslateAcceleratorW GetWindowRect GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DestroyIcon DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW IsWindowVisible IsWindow CreateWindowExW SetWindowTextW AdjustWindowRectEx GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos DrawTextW SetCursor TrackMouseEvent SystemParametersInfoW GetWindowTextW FillRect GetWindowTextLengthW GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient LoadCursorW PostMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect IsIconic SendMessageW RedrawWindow AdjustWindowRect SetWindowLongPtrW

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

gdi32

SelectObject DeleteObject CreateRectRgn GetDeviceCaps BitBlt CreateCompatibleDC DeleteDC CreateDIBSection CreateSolidBrush CombineRgn SetBkMode SetTextColor

ole32

CoCreateInstance CoUninitialize OleInitialize RegisterDragDrop CoInitializeEx RevokeDragDrop CoCreateFreeThreadedMarshaler

shlwapi

SHCreateMemStream

shell32

DragFinish DragQueryFileW SHGetKnownFolderPath ShellExecuteW SHAppBarMessage

combase

CoTaskMemFree CoTaskMemAlloc

ws2_32

WSAStartup WSACleanup closesocket getaddrinfo freeaddrinfo connect send WSAGetLastError WSASocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo SysFreeString GetErrorInfo SysStringLen

api-ms-win-crt-math-l1-1-0

pow roundf floor __setusermatherr round trunc

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

__p___argv _exit exit _initterm_e _initterm _cexit _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate abort __p___argc _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc malloc free