swes5s1pbi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
swes5s1pbi.exe
Size 95.4MB
Sample260814-2e13caap4s
SHA256 9927038828f904e052c0977f9a5d8462359cc2d7536a4bcc06993ee1a627248b
MD5 321d749804e4c38a57a1007b6f02295c
SHA1 6c5b673fc8c263fa30de425030f36f07b3de1d18
SHA512 7ecec6ca70ef729b56a5d1f3e8c5e1ba2d95202c893e7efee87968e8bc005a722c4eaba25f466ed331d6d2d702d3a554afb03989f0f81aa71621f1a0f75c2bed
SSDEEP 1572864:QFZnbB+CPbghucA5U0Vd2q/Lk6hVB5vvK8sdkY:Sn3d5U0Vd2q/LkaDS8sL
TLSH
T1B628F116B69505AFE07AC178CA8AAB13F7727009033157EB07D487B21F67BE45F3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
swes5s1pbi.exe

File Explorer

swes5s1pbi.exe

.exe 95.4MB

swes5s1pbi.exe

IMPHASH de330e4708240365608d2314845588c1
SHA256 9927038828f904e052c0977f9a5d8462359cc2d7536a4bcc06993ee1a627248b
MD5 321d749804e4c38a57a1007b6f02295c
SHA1 6c5b673fc8c263fa30de425030f36f07b3de1d18
SHA512 7ecec6ca70ef729b56a5d1f3e8c5e1ba2d95202c893e7efee87968e8bc005a722c4eaba25f466ed331d6d2d702d3a554afb03989f0f81aa71621f1a0f75c2bed
SSDEEP 1572864:QFZnbB+CPbghucA5U0Vd2q/Lk6hVB5vvK8sdkY:Sn3d5U0Vd2q/LkaDS8sL
TLSH
T1B628F116B69505AFE07AC178CA8AAB13F7727009033157EB07D487B21F67BE45F3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32371372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice CreateDirect3D11DeviceFromDXGIDevice

dxgi

CreateDXGIFactory2

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess CreateProcessA GetCurrentProcessId ExitProcess CreateThread GetCurrentThread SetThreadPriority SwitchToThread GetStartupInfoW ExitThread TerminateProcess TlsFree GetExitCodeThread TlsGetValue GetThreadPriority GetCurrentThreadId GetExitCodeProcess FlushProcessWriteBuffers TlsAlloc CreateProcessW TlsSetValue

api-ms-win-core-libraryloader-l1-2-0

LockResource GetModuleHandleA GetModuleFileNameW SizeofResource GetProcAddress LoadResource FreeLibraryAndExitThread GetModuleHandleExW GetModuleHandleW LoadLibraryExA FreeLibrary GetModuleFileNameA LoadLibraryExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA FindResourceW LoadLibraryW

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar CompareStringW CompareStringEx

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegCloseKey RegOpenKeyExW RegQueryValueExW

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation QueryFullProcessImageNameW

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce SleepConditionVariableCS Sleep InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-com-l1-1-0

CoCreateInstance CoInitializeEx CoCreateFreeThreadedMarshaler CoUninitialize CoTaskMemFree CLSIDFromString PropVariantClear

oleaut32

VariantClear SetErrorInfo SysStringLen GetErrorInfo SysFreeString

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation DuplicateHandle

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW GetMonitorInfoW EnumDisplayMonitors EnumDisplayDevicesW GetSystemMetrics

api-ms-win-core-file-l1-1-0

RemoveDirectoryW SetFilePointerEx GetFinalPathNameByHandleW GetFileSizeEx GetFileAttributesW CreateDirectoryW CreateDirectoryA CreateFileA GetFileAttributesA SetEndOfFile ReadFile SetFilePointer GetFileTime GetLogicalDrives FindFirstFileExW GetFileType GetFileAttributesExW SetFileInformationByHandle GetDriveTypeW WriteFile DeleteFileA GetFileInformationByHandle FindNextFileW DeleteFileW CreateFileW GetFullPathNameW FindFirstFileW FindClose GetDriveTypeA SetFileAttributesA FlushFileBuffers

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter RaiseException SetLastError SetErrorMode

api-ms-win-core-io-l1-1-0

GetOverlappedResult CancelIoEx DeviceIoControl

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive TryEnterCriticalSection EnterCriticalSection DeleteCriticalSection AcquireSRWLockExclusive ReleaseSemaphore ReleaseSRWLockShared LeaveCriticalSection InitializeSRWLock AcquireSRWLockShared InitializeCriticalSection CreateEventExW ResetEvent TryAcquireSRWLockExclusive InitializeCriticalSectionEx SetEvent SleepEx CreateEventA ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW CreateEventW InitializeCriticalSectionAndSpinCount

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx GetTickCount GetSystemDirectoryW GetLogicalProcessorInformationEx GetSystemTimeAsFileTime GetLogicalProcessorInformation GetTickCount64 GetSystemDirectoryA GetSystemInfo GetSystemTime

api-ms-win-core-comm-l1-1-0

SetCommState SetCommTimeouts SetCommMask WaitCommEvent GetCommState

api-ms-win-core-file-l1-2-2

GetTempFileNameA AreFileApisANSI GetTempPathA GetVolumeInformationA

api-ms-win-core-file-ansi-l1-1-0

GetLogicalDriveStringsA

api-ms-win-core-namedpipe-l1-1-0

SetNamedPipeHandleState PeekNamedPipe CreatePipe

bcrypt

BCryptGenRandom

mfplat

MFStartup MFCreateAttributes MFCreateSample MFShutdown MFCreateMediaType MFCreateMemoryBuffer MFCreateMFByteStreamOnStream

mfreadwrite

MFCreateSinkWriterFromURL

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler RemoveVectoredExceptionHandler

api-ms-win-core-console-l1-1-0

GetConsoleMode SetConsoleMode GetConsoleOutputCP WriteConsoleW ReadConsoleA ReadConsoleW SetConsoleCtrlHandler

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA GetStartupInfoA CreateFileMappingA GetSystemPowerStatus GetComputerNameW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx CopyFileExW MoveFileExW

api-ms-win-core-heap-l2-1-0

LocalFree GlobalAlloc GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalSize GlobalUnlock

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsGetValue FlsSetValue

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetNativeSystemInfo VerSetConditionMask

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle GetCommandLineA SetStdHandle GetEnvironmentStringsW GetEnvironmentVariableA SetEnvironmentVariableA SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentDirectoryW FreeEnvironmentStringsW GetCommandLineW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource RegisterEventSourceW ReportEventW

api-ms-win-core-memory-l1-1-0

VirtualFree VirtualProtect CreateFileMappingW VirtualAlloc VirtualQuery MapViewOfFile UnmapViewOfFile

api-ms-win-core-memory-l1-1-1

GetLargePageMinimum

api-ms-win-core-localization-l1-2-0

IsValidLocale GetCPInfo GetLocaleInfoW GetLocaleInfoA GetOEMCP GetUserDefaultLCID LCMapStringEx GetLocaleInfoEx GetACP FormatMessageW IsValidCodePage LCMapStringW EnumSystemLocalesW FormatMessageA

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwindEx RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureStackBackTrace

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA

api-ms-win-security-cryptoapi-l1-1-0

CryptEnumProvidersW CryptGetProvParam CryptExportKey CryptSignHashW CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptGenRandom CryptDestroyHash

crypt32

CertFreeCertificateChainEngine CertFreeCertificateChain CertFindExtension CryptQueryObject PFXImportCertStore CryptDecodeObjectEx CertOpenStore CertCreateCertificateChainEngine CertCloseStore CertGetCertificateChain CertEnumCertificatesInStore CertOpenSystemStoreW CertFindCertificateInStore CertAddCertificateContextToStore CryptStringToBinaryW CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertGetNameStringW

ws2_32

connect closesocket ioctlsocket getsockname getsockopt ntohs select gethostbyname WSAStartup listen WSAGetLastError bind htonl setsockopt accept shutdown htons getpeername inet_addr inet_ntoa getservbyport WSACleanup gethostbyaddr inet_pton getservbyname WSASetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents recvfrom WSAEventSelect WSACloseEvent gethostname WSAIoctl sendto WSAResetEvent WSACreateEvent getaddrinfo __WSAFDIsSet recv send freeaddrinfo socket

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-heap-l1-1-0

HeapSize HeapQueryInformation HeapFree GetProcessHeap HeapReAlloc HeapAlloc

d3d12

D3D12SerializeVersionedRootSignature ord101

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-processtopology-l1-1-0

SetThreadGroupAffinity GetThreadGroupAffinity

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetThreadTimes GetCurrentProcessorNumber IsProcessorFeaturePresent GetCurrentProcessorNumberEx

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventUnregister EventWriteTransfer

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash PathCchRemoveFileSpec

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-mm-time-l1-1-0

timeEndPeriod timeBeginPeriod

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-5

SetThreadExecutionState

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-libraryloader-l1-2-2

EnumResourceNamesW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoA

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

user32

RegisterClassExW CreateWindowExW DestroyWindow GetRawInputData ShowWindow GetWindowLongW SetWindowLongW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetProcessWindowStation SendMessageTimeoutW SetProcessDpiAwarenessContext GetUserObjectInformationW MessageBoxW MessageBoxA GetDoubleClickTime RegisterWindowMessageA InvalidateRect CallNextHookEx GetRawInputBuffer GetRawInputDeviceList GetForegroundWindow GetAsyncKeyState GetKeyState GetMessageTime GetRawInputDeviceInfoA GetPropW CallWindowProcW GetMessageExtraInfo KillTimer SetTimer GetMessagePos PeekMessageW MsgWaitForMultipleObjects LoadIconW DestroyIcon GetClassInfoExW DefWindowProcW UnregisterClassA RegisterClassExA CreateWindowExA SetWindowPos RegisterDeviceNotificationW GetWindowLongPtrW SetForegroundWindow GetClientRect TrackPopupMenu DispatchMessageW CheckMenuItem SetWindowLongPtrW CreatePopupMenu DeleteMenu DestroyMenu InsertMenuW SetMenuItemInfoW TrackMouseEvent ScreenToClient GetMessageW RegisterClassW RegisterRawInputDevices GetDesktopWindow EnumDisplaySettingsW ChangeDisplaySettingsExW ReleaseDC SetPropW SetRectEmpty GetMenu GetFocus GetWindowTextLengthW GetWindowTextW UnhookWindowsHookEx RemovePropW SetWindowTextW CreateIconFromResource EnableWindow GetWindowThreadProcessId AttachThreadInput SetFocus SetActiveWindow UnregisterClassW UnregisterDeviceNotification GetClipCursor PtInRect ClipCursor IntersectRect SetWindowsHookExW AdjustWindowRectEx SetLayeredWindowAttributes RegisterClipboardFormatW FlashWindowEx SetParent GetClipboardFormatNameA SetWindowRgn ToUnicode GetKeyboardLayout GetClipboardSequenceNumber IsClipboardFormatAvailable EnumClipboardFormats SetCursorPos LoadCursorW DestroyCursor PostThreadMessageW GetMenuItemInfoW SetCursor MapVirtualKeyW IsZoomed GetWindowPlacement IsWindow MonitorFromWindow SetCapture ReleaseCapture CreateIconIndirect GetQueueStatus DrawTextW SystemParametersInfoA DialogBoxIndirectParamW GetDlgItem MonitorFromPoint GetUpdateRect BeginPaint EndPaint ValidateRect SendMessageW TranslateMessage VkKeyScanA GetKeyboardState GetParent MoveWindow EndDialog GetClassNameW GetDC ClientToScreen IsIconic EnableMenuItem IsWindowVisible GetCursorPos PostMessageW FillRect SendMessageA GetWindowRect

kernel32

GetMaximumProcessorGroupCount GetMaximumProcessorCount

shell32

SHGetFolderPathW ShellExecuteW DragQueryFileW DragFinish Shell_NotifyIconW DragAcceptFiles SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteA SHCreateDirectoryExW

setupapi

SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW CM_Locate_DevNodeA SetupDiGetDeviceInstanceIdA SetupDiGetClassDevsW CM_Get_Device_IDA

shlwapi

ord12

ole32

OleUninitialize RevokeDragDrop RegisterDragDrop OleInitialize ReleaseStgMedium

version

GetFileVersionInfoSizeW GetFileVersionInfoSizeA

secur32

InitSecurityInterfaceW

xmllite

CreateXmlReader

gdi32

GetTextMetricsW GetTextExtentPoint32A SetPixel SetPixelFormat GetICMProfileW CreateRectRgn DeleteObject CreateFontIndirectW CreateDCW CreateCompatibleBitmap GetDIBits DeleteDC GetDeviceCaps CreateBitmap CreateCompatibleDC CreateDIBSection SelectObject BitBlt CombineRgn SwapBuffers CreateSolidBrush DescribePixelFormat GetPixelFormat ChoosePixelFormat

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContext ImmGetCompositionFontW ImmNotifyIME ImmSetCompositionStringW ImmGetCandidateListW ImmGetCompositionStringW ImmGetIMEFileNameA

advapi32

CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam

dbghelp

ImageDirectoryEntryToData SymFromAddr

iphlpapi

if_nametoindex

api-ms-win-core-processenvironment-l1-2-0

SearchPathA

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CloseThreadpoolTimer

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList QueryDepthSList InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

32.2MB

Virtual Size

32.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.4MB

Virtual Size

10.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49.8MB

Virtual Size

49.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

430KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ