AI Reverse[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AI Reverse.exe
Size 10.8MB
Sample260813-e6x4fabk8w
SHA256 cbe562a657ed369f94e962b1186589c3cc93e76dd49208e1ca83306d8c0e6b20
MD5 542bd836c00e123fe5468ac9ffee3f11
SHA1 47a4e7fdc0ac6f9f2b1b989ac74206b8dc1d85c2
SHA512 6d996c3d1cb18ea9b4d3bfd9d000dcd370a961c7ee59f59c8fdb37bf868a282ca7d4e7ce7bfbec228690bb5300fa266c5e3e02da46ea1cf97201757b2eb1d7a5
SSDEEP 49152:BjxUhZYR8VGoTTPIsPBYYKz7w/3X6NMZt49AmXD7ebMc4LSW3VdpNMnTaAoZLbHR:BjxXAP58MNAVLNMn/i0zkbW0rLlw6C
TLSH
T1FEB68C19B661C0E9C56A8274CD9BCA4AEB71BC440F2247DB32E1337E5E373D42E7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AI Reverse.exe

File Explorer

AI Reverse.exe

.exe 10.8MB

AI Reverse.exe

IMPHASH 4a71d6562127145bee92a57150558581
SHA256 cbe562a657ed369f94e962b1186589c3cc93e76dd49208e1ca83306d8c0e6b20
MD5 542bd836c00e123fe5468ac9ffee3f11
SHA1 47a4e7fdc0ac6f9f2b1b989ac74206b8dc1d85c2
SHA512 6d996c3d1cb18ea9b4d3bfd9d000dcd370a961c7ee59f59c8fdb37bf868a282ca7d4e7ce7bfbec228690bb5300fa266c5e3e02da46ea1cf97201757b2eb1d7a5
SSDEEP 49152:BjxUhZYR8VGoTTPIsPBYYKz7w/3X6NMZt49AmXD7ebMc4LSW3VdpNMnTaAoZLbHR:BjxXAP58MNAVLNMn/i0zkbW0rLlw6C
TLSH
T1FEB68C19B661C0E9C56A8274CD9BCA4AEB71BC440F2247DB32E1337E5E373D42E7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4164208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DebugActiveProcessStop GetTickCount64 FreeLibrary LoadLibraryExW DebugSetProcessKillOnExit DebugBreakProcess Heap32ListFirst Heap32ListNext Heap32First Heap32Next WriteFile GetModuleFileNameW GetModuleHandleExW LoadLibraryW CreateFileA DeleteFileA LockFileEx GetTempPathA SetEvent CreateEventA GetCurrentProcessId FormatMessageA GetLocalTime GetComputerNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA AttachConsole GetEnvironmentVariableA FlushFileBuffers GetFileType SetFilePointer SetFilePointerEx SetErrorMode GetStdHandle OutputDebugStringW GetConsoleMode WriteConsoleW GetCurrentThreadId GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore WaitForSingleObjectEx CreateSemaphoreW ExitProcess GetSystemInfo RaiseException AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateThread GetCurrentThread SetThreadPriority SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetLocaleInfoW SetThreadExecutionState QueryPerformanceCounter QueryPerformanceFrequency CreateEventW GetTickCount IsWow64Process EnumResourceNamesW HeapFree GetProcessHeap VerSetConditionMask DeviceIoControl GetOverlappedResult CancelIo ResetEvent FormatMessageW VerifyVersionInfoW GetCommandLineW HeapAlloc WaitForMultipleObjects GetFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree FindFirstFileExW CreateToolhelp32Snapshot GetLogicalDrives RemoveDirectoryW CopyFileExW MoveFileExW DuplicateHandle SetHandleInformation CreatePipe SetNamedPipeHandleState GenerateConsoleCtrlEvent MulDiv GlobalSize WaitForDebugEvent GetSystemPowerStatus GetLocaleInfoA GetFileAttributesW GetFileInformationByHandle VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapSize SetEnvironmentVariableW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext ReadConsoleW GetConsoleOutputCP SetStdHandle SetEndOfFile SetConsoleCtrlHandler IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime WideCharToMultiByte MultiByteToWideChar GetActiveProcessorCount LocalFree QueryThreadCycleTime GetProcAddress GetModuleHandleW VirtualFreeEx WriteProcessMemory ReadProcessMemory VirtualQueryEx VirtualProtectEx VirtualAllocEx GetSystemTimeAsFileTime GlobalMemoryStatusEx OpenProcess GetThreadTimes FlushInstructionCache SetThreadContext GetThreadContext GetProcessIdOfThread CreateProcessW ResumeThread DebugActiveProcess RtlUnwind ContinueDebugEvent GetFinalPathNameByHandleW GetTempPathW CreateDirectoryW K32GetProcessMemoryInfo Module32NextW Module32FirstW Thread32Next Thread32First Process32NextW CompareStringA Process32FirstW SuspendThread GetExitCodeThread TerminateThread OpenThread CreateRemoteThread GetExitCodeProcess TerminateProcess GetCurrentProcess GetProcessTimes Sleep WaitForSingleObject SetLastError GetLastError CloseHandle ReadFile GetFileSizeEx FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCurrentDirectoryW GetFileAttributesExW SetConsoleTitleA

user32

SetCursorPos ReleaseCapture SetCapture EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode GetKeyboardState GetKeyboardLayout SetWindowRgn IsClipboardFormatAvailable EnumClipboardFormats RegisterClipboardFormatW GetClipboardSequenceNumber SystemParametersInfoW SystemParametersInfoA GetWindowTextA EnumWindows GetClassNameA DrawTextW SetFocus GetDlgItem EndDialog DialogBoxIndirectParamW GetDesktopWindow PostThreadMessageW GetMessageW RegisterRawInputDevices GetRawInputData IsWindow LoadCursorW GetWindowThreadProcessId GetActiveWindow MessageBoxA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard ShowWindow GetWindowLongW SetWindowLongW GetDoubleClickTime DestroyCursor CreateIconFromResourceEx RegisterWindowMessageA TrackMouseEvent TranslateMessage DispatchMessageW ReleaseDC RegisterClassW SetWindowLongPtrW GetWindowLongPtrW SetForegroundWindow SetMenuItemInfoW GetMenuItemInfoW TrackPopupMenu DeleteMenu InsertMenuW EnableMenuItem CheckMenuItem DestroyMenu CreatePopupMenu CreateWindowExW RegisterWindowMessageW DestroyWindow AttachThreadInput SetLayeredWindowAttributes FlashWindowEx GetClipboardFormatNameA GetFocus GetQueueStatus CreateIconFromResource UnhookWindowsHookEx SetWindowsHookExW SetParent PtInRect IntersectRect ClipCursor GetClipCursor GetWindowTextLengthW GetWindowTextW SetWindowTextW RemovePropW SetActiveWindow SetPropW EnableWindow CreateWindowExA RegisterClassExA UnregisterClassA CreateIconIndirect PeekMessageW GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW SetWindowPos GetWindowPlacement IsIconic IsZoomed GetKeyState GetAsyncKeyState MapVirtualKeyW MsgWaitForMultipleObjects SetTimer KillTimer GetSystemMetrics GetMenu GetForegroundWindow GetDC BeginPaint EndPaint GetUpdateRect ValidateRect GetPropW GetClientRect GetWindowRect AdjustWindowRectEx SetCursor GetCursorPos ClientToScreen ScreenToClient FillRect SetRectEmpty CallNextHookEx LoadIconW DestroyIcon MonitorFromPoint UnregisterDeviceNotification RegisterDeviceNotificationW GetMessageA GetRawInputDeviceList GetRawInputBuffer GetRawInputDeviceInfoA GetMonitorInfoW MonitorFromWindow

gdi32

BitBlt GetICMProfileW GetPixelFormat GetDIBits CreateDCW CreateCompatibleBitmap CreateRectRgn CombineRgn SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat GetTextMetricsW GetTextExtentPoint32A GetDeviceCaps CreateFontIndirectW CreateDIBSection SetPixel SelectObject DeleteDC CreateCompatibleDC CreateBitmap CreateSolidBrush DeleteObject

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetIMEFileNameA ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetCompositionFontW ImmNotifyIME ImmGetContext

ole32

ReleaseStgMedium CoCreateInstance CoInitializeEx CoUninitialize OleUninitialize OleInitialize CoTaskMemFree CLSIDFromString PropVariantClear RevokeDragDrop RegisterDragDrop

oleaut32

SysFreeString

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

advapi32

OpenProcessToken LookupPrivilegeValueW GetSecurityInfo SetSecurityInfo RegCloseKey RegCreateKeyExW RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW AdjustTokenPrivileges

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA

shell32

ShellExecuteA SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW DragQueryFileW DragFinish Shell_NotifyIconW CommandLineToArgvW SHGetFolderPathW DragAcceptFiles

comdlg32

GetSaveFileNameW GetOpenFileNameW

dbghelp

SymInitializeW SymCleanup SymLoadModuleExW SymEnumSymbols StackWalk64 SymFunctionTableAccess64 SymFromAddr SymInitialize SymGetModuleBase64 SymSetOptions

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptSetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptExportKey BCryptImportKeyPair BCryptGenerateSymmetricKey BCryptDestroyKey BCryptDestroySecret BCryptVerifySignature BCryptSecretAgreement BCryptDeriveKey BCryptCreateHash BCryptGenRandom BCryptHashData BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptEncrypt BCryptFinishHash BCryptDestroyHash BCryptGetProperty

crypt32

CryptUnprotectData CryptProtectData

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1004KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

210KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AI Reverse.exe

kernel32

user32

gdi32

winmm

imm32

ole32

oleaut32

version

advapi32

setupapi

shell32

comdlg32

dbghelp

winhttp

bcrypt

crypt32

generic