test (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
test (1).exe
Size 539KB
Sample260814-dq343stdkg
SHA256 cf1ed961af430c1341a512380f686a089bbe9b23c5ae15368ab57772d6b5664c
MD5 200828903010f0f4f154ef215a9010e2
SHA1 778424c14e0f027ec69c0de34cf07d0c285dbf85
SHA512 1187140a184ca17fc9def4a2ef12665b37e0f2b944d8c33de875f69e9a3bc781738b7ac604925b3d0a2c1c86ad568795df7d27f2d618da98d6fa21d80cee2fc6
SSDEEP 12288:1as8M/qe7eNMF14tIycQ9iF2yBTf2O4YqJ2d90H+dM+G/GozWCEJKbt:1as8M/qe7QMF14d9uVfL4YqQd9WL+GOa
TLSH
T1AFC44B2EA25403B5D1F7C1788E476457EF7238490336EEF717E1A5A21E1B9E0AB3B610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
test (1).exe

File Explorer

test (1).exe

.exe 539KB

test (1).exe

IMPHASH 7a022913b314636b2c36cdde37910317
SHA256 cf1ed961af430c1341a512380f686a089bbe9b23c5ae15368ab57772d6b5664c
MD5 200828903010f0f4f154ef215a9010e2
SHA1 778424c14e0f027ec69c0de34cf07d0c285dbf85
SHA512 1187140a184ca17fc9def4a2ef12665b37e0f2b944d8c33de875f69e9a3bc781738b7ac604925b3d0a2c1c86ad568795df7d27f2d618da98d6fa21d80cee2fc6
SSDEEP 12288:1as8M/qe7eNMF14tIycQ9iF2yBTf2O4YqJ2d90H+dM+G/GozWCEJKbt:1as8M/qe7QMF14d9uVfL4YqQd9WL+GOa
TLSH
T1AFC44B2EA25403B5D1F7C1788E476457EF7238490336EEF717E1A5A21E1B9E0AB3B610
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

394588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\EMUlorant\emu\src\source\x64\Release\test.pdb

kernel32

FindFirstFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW FindClose GetFileInformationByHandleEx Sleep WideCharToMultiByte FormatMessageA GetCurrentDirectoryW GetExitCodeProcess FlushFileBuffers ConnectNamedPipe GetSystemTime CreateFileMappingA CreateToolhelp32Snapshot GetModuleHandleA CreateFileW CreateMutexA CreateNamedPipeW GetModuleFileNameW TerminateProcess DeviceIoControl OutputDebugStringA WriteFile GetLocaleInfoEx ReleaseSRWLockExclusive Beep CloseHandle Process32FirstW DeleteFileW CreateFileA Process32NextW GetLastError AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess CreateDirectoryW ReadFile MultiByteToWideChar LocalFree

user32

LoadCursorW GetAsyncKeyState GetWindowTextLengthW GetKeyState GetMessageA DispatchMessageA DestroyWindow GetClientRect SendMessageW ShowWindow SetTimer DrawTextA GetDlgCtrlID GetWindowTextA SetWindowTextA DefWindowProcA CreateWindowExA GetDlgItem PostQuitMessage RegisterClassExA UpdateWindow InvalidateRect BeginPaint EndPaint FillRect TranslateMessage

gdi32

CreateFontA SelectObject SetTextColor SetBkColor DeleteObject CreateSolidBrush SetBkMode

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Xtime_get_ticks _Mtx_unlock _Strxfrm ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

comctl32

ord413 ord17 ord410

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyKey BCryptEncrypt BCryptDestroyHash BCryptFinishHash BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenRandom BCryptHashData

crypt32

CryptDecodeObjectEx CryptImportPublicKeyInfoEx2 CertCreateSelfSignCertificate CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CertStrToNameA

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

ws2_32

accept WSAGetLastError setsockopt htons htonl recv connect socket send WSAStartup listen bind closesocket

secur32

AcquireCredentialsHandleW FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext EncryptMessage FreeContextBuffer DecryptMessage

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy __std_terminate strchr wcsrchr memcmp memcpy memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _errno _invoke_watson terminate _initialize_onexit_table _register_onexit_function _crt_atexit system _beginthreadex abort

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _localtime64_s _time64

api-ms-win-crt-stdio-l1-1-0

fputc fopen fclose __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos fread fgets ungetc __stdio_common_vsprintf fwrite setvbuf fgetpos fflush fgetc __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s wcscat_s isxdigit tolower isdigit isalnum

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr