t6sp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
t6sp.exe
Size 11.0MB
Sample260812-wehccazvbw
SHA256 9c41762e6ab9b583d50512262e8a683bbd5b6e785ff332d92a74f18b1b230048
MD5 9e96e03e6115ff54f5bfa64377dbc818
SHA1 2eba6b66ade2afb38f7d4cf43a9df7379967e9a8
SHA512 9a757593fcfc5043ee3f692d3e6bf39cd6b2b0e70f850afe98703d2c4d77934b38615ae1eb18cb474be1ba0d993a0bcc732a5e3aee6cd9681ba60c223e12f17d
SSDEEP 98304:VUevZtUq0Wi4UZwn1t1rv2gEcCqMNM0jPERAYP3TsmDVaQawS:3yJi1ru1cCqMS0XYP1DdS
TLSH
T161C68D01B7A38DF1C05C3574F0AA763FE936715C5F2946D3A7E0390899E02D86AFB299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
t6sp.exe

File Explorer

t6sp.exe

.exe 11.0MB

t6sp.exe

IMPHASH 7012c8bb82baaddc12159b218b19e041
SHA256 9c41762e6ab9b583d50512262e8a683bbd5b6e785ff332d92a74f18b1b230048
MD5 9e96e03e6115ff54f5bfa64377dbc818
SHA1 2eba6b66ade2afb38f7d4cf43a9df7379967e9a8
SHA512 9a757593fcfc5043ee3f692d3e6bf39cd6b2b0e70f850afe98703d2c4d77934b38615ae1eb18cb474be1ba0d993a0bcc732a5e3aee6cd9681ba60c223e12f17d
SSDEEP 98304:VUevZtUq0Wi4UZwn1t1rv2gEcCqMNM0jPERAYP3TsmDVaQawS:3yJi1ru1cCqMS0XYP1DdS
TLSH
T161C68D01B7A38DF1C05C3574F0AA763FE936715C5F2946D3A7E0390899E02D86AFB299
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5683036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\t6\code\src\obj\t6\codSteam_CEG_bin\t6sp.pdb

steam_api

SteamAPI_RegisterCallResult SteamAPI_RegisterCallback SteamUserStats SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamAPI_Init SteamUtils SteamApps SteamFriends SteamAPI_RestartAppIfNecessary SteamUser

winmm

mixerGetLineControlsA timeEndPeriod timeBeginPeriod mixerOpen mixerSetControlDetails mixerGetDevCapsA waveInGetNumDevs mixerGetNumDevs timeGetTime mixerClose mixerGetControlDetailsA mixerGetLineInfoA

wsock32

recv WSAGetLastError gethostbyname ioctlsocket sendto closesocket bind htons setsockopt inet_ntoa socket gethostname WSAStartup select recvfrom send __WSAFDIsSet shutdown

faultrep

ReportFault

dxgi

CreateDXGIFactory1

dsound

ord6 ord11

kernel32

FormatMessageA SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CompareStringW HeapQueryInformation GetExitCodeProcess CreatePipe LoadLibraryW SetConsoleCtrlHandler CreateDirectoryA CreateMutexA HeapAlloc CreateFileW InterlockedExchange CloseHandle GetFileInformationByHandleEx HeapFree CreateFileA GetCurrentThreadId GetTickCount lstrlenW GetStartupInfoW GetModuleFileNameA InterlockedIncrement CreateSemaphoreA InterlockedCompareExchange Sleep GetCurrentProcessId GetModuleHandleA GetLastError ReleaseSemaphore GetFileInformationByHandle OpenFileById GetTimeZoneInformation GetProcessHeap lstrcmpiW FileTimeToSystemTime GetProcessTimes GetCurrentProcess UnmapViewOfFile HeapSize SetLastError GetFullPathNameW GetEnvironmentStringsW GetComputerNameA GetModuleHandleExA ExitProcess GetFileAttributesA GetConsoleWindow SizeofResource LoadLibraryA GetSystemTime WriteFile QueryPerformanceFrequency VirtualQuery GetCommandLineW GetCurrentDirectoryW LockResource CreateEventA WaitForSingleObject GetFullPathNameA SetEvent CreateFileMappingA MapViewOfFile ReleaseMutex AddVectoredExceptionHandler GetFileTime LoadResource GetProcAddress DebugBreak GetSystemTimeAsFileTime FindResourceW InterlockedDecrement InterlockedExchangeAdd QueryPerformanceCounter DeleteFileA SetFileAttributesA GetCurrentDirectoryA CreateThread FreeLibrary SetFilePointer GetFileSize ReadFile RaiseException ResetEvent GetProcessAffinityMask DuplicateHandle GetCurrentThread SuspendThread ResumeThread SetThreadPriority VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection TryEnterCriticalSection LeaveCriticalSection GlobalMemoryStatus SetProcessAffinityMask GetThreadPriority OutputDebugStringA GetDriveTypeA GlobalUnlock GlobalSize GlobalLock GetVersionExA SetErrorMode SetUnhandledExceptionFilter TerminateProcess WaitForMultipleObjects MulDiv SetPriorityClass SetThreadExecutionState WideCharToMultiByte GetSystemInfo GetSystemDirectoryW OpenFileMappingA GetModuleFileNameW GetWindowsDirectoryW OpenEventA HeapCreate HeapDestroy CreateSemaphoreW GetModuleHandleW OpenProcess PulseEvent FindClose FileTimeToLocalFileTime FindFirstFileExA FindNextFileA GetDriveTypeW ExitThread HeapReAlloc CreateProcessA GetTimeFormatA GetDateFormatA GetCommandLineA HeapSetInformation PeekNamedPipe GetFileType IsProcessorFeaturePresent GetStdHandle GetLocaleInfoW UnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEnvironmentVariableW SetEnvironmentVariableA GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount DecodePointer EncodePointer GetVersion FlushConsoleInputBuffer MultiByteToWideChar RtlUnwind ReadConsoleInputA SetConsoleMode RemoveVectoredExceptionHandler MoveFileA

user32

MoveWindow MapVirtualKeyA CloseWindow SetWindowTextA CallWindowProcA GetMonitorInfoA DestroyWindow DefWindowProcA LoadCursorA RegisterClassA PostQuitMessage RegisterWindowMessageA LoadImageA CreateWindowExA SendMessageA AdjustWindowRect SetWindowPos GetSystemMetrics LoadIconA RegisterClassExA OpenClipboard GetClipboardData CloseClipboard GetMessageA DispatchMessageA TranslateMessage SetCursor GetClientRect ShowWindow ClientToScreen GetCursorPos ScreenToClient GetForegroundWindow SetFocus GetWindowRect SetCursorPos GetActiveWindow ChangeDisplaySettingsA EnumThreadWindows GetDesktopWindow GetDC ReleaseDC GetWindowTextA GetWindowLongA SetWindowLongA PostMessageA MessageBoxA ShowCursor GetClassLongA AdjustWindowRectEx IsWindow GetMenuItemCount SetClassLongA PeekMessageA EnumDisplaySettingsA DeleteMenu GetMenuItemID GetSystemMenu GetUserObjectInformationW GetProcessWindowStation MonitorFromWindow

gdi32

DeleteDC DeleteObject GetBitmapBits BitBlt GetObjectA SelectObject CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC CreateDCA GetDeviceCaps CreateFontA SetDeviceGammaRamp

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegisterEventSourceA ReportEventA DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextA RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteA SHGetFolderPathA

ole32

StringFromGUID2 CoCreateInstance CoUninitialize CLSIDFromString CoInitializeEx

xinput1_3

ord4 ord3 ord2

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

ws2_32

getsockname WSASetLastError connect inet_ntoa ntohs

psapi

GetProcessMemoryInfo

binkw32

_BinkSetSoundTrack@8 _BinkDoFrame@4 _BinkClose@4 _BinkStartAsyncThread@8 _BinkGetError@0 _BinkOpen@8 _BinkWaitStopAsyncThread@4 _BinkGetRealtime@12 _BinkSetMemory@8 _BinkDoFrameAsyncWait@8 _BinkGetRects@8 _BinkRequestStopAsyncThread@4 _BinkRegisterFrameBuffers@8 _BinkNextFrame@4 _BinkGetFrameBuffersInfo@8 _BinkPause@8 _BinkControlBackgroundIO@8 _BinkDoFrameAsync@12 _BinkSetIOSize@4

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.conceal

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.interpr

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.0MB

Virtual Size

53.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

t6sp.exe

steam_api

winmm

wsock32

faultrep

dxgi

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

wtsapi32

ws2_32

psapi

binkw32

d3d11

generic