Tsumugi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Tsumugi.exe
Size 4.3MB
Sample260814-ebmzzstybw
SHA256 21e21805c434032fc7835b70ad40a211404b3ae97dd9d8df857fe2165f862f09
MD5 977133a9c88993f718d74b410f715bf3
SHA1 e030838e59735bf540cd22b8f8d40e13c1a5e24c
SHA512 c551e15efab691e94a2e76a564b24289f8d825cd9de2bc08af11c789f9f07cf896c9270f90c03ee90ac5262881e44067312f7b7b3ab062ffb4f543773cf9b215
SSDEEP 98304:YDCijVOydqj5XjtzZsXYzFNM81zm+0IqdX/B3yv7Vf:pOOydqj7wY/M88+cC
TLSH
T1FB26BF11BB91C13AE9F202B19A7DAB9F502CBE251B2440CB72DC4E9D1DB16D32B36717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tsumugi.exe

File Explorer

Tsumugi.exe

.exe 4.3MB

Tsumugi.exe

IMPHASH 277b6e27b5785f425f2394d28495d60e
SHA256 21e21805c434032fc7835b70ad40a211404b3ae97dd9d8df857fe2165f862f09
MD5 977133a9c88993f718d74b410f715bf3
SHA1 e030838e59735bf540cd22b8f8d40e13c1a5e24c
SHA512 c551e15efab691e94a2e76a564b24289f8d825cd9de2bc08af11c789f9f07cf896c9270f90c03ee90ac5262881e44067312f7b7b3ab062ffb4f543773cf9b215
SSDEEP 98304:YDCijVOydqj5XjtzZsXYzFNM81zm+0IqdX/B3yv7Vf:pOOydqj7wY/M88+cC
TLSH
T1FB26BF11BB91C13AE9F202B19A7DAB9F502CBE251B2440CB72DC4E9D1DB16D32B36717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2332787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

tvpwin32.pdb

kernel32

VirtualQuery FindResourceW LoadResource IsBadReadPtr OpenProcess GlobalAlloc Sleep SizeofResource GetVersionExW GlobalFree LockResource GlobalMemoryStatusEx SetCurrentDirectoryW HeapSetInformation GetCurrentThreadId GetSystemTime CreateMutexW HeapQueryInformation GetProcessHeaps HeapWalk LoadLibraryExW GetNativeSystemInfo HeapAlloc HeapFree VirtualFree SetLastError VirtualAlloc LoadLibraryA VirtualProtect GetConsoleMode FreeConsole WriteConsoleW GetLocalTime SetConsoleTitleW GetProcessAffinityMask SetThreadAffinityMask GlobalMemoryStatus TerminateProcess GetCurrentThread SetThreadPriority GlobalDeleteAtom GlobalAddAtomW MulDiv OutputDebugStringW FormatMessageW SearchPathW GetSystemDirectoryW GetWindowsDirectoryW WideCharToMultiByte IsDBCSLeadByte MultiByteToWideChar GlobalLock GlobalUnlock InterlockedIncrement InterlockedDecrement WaitForSingleObject InterlockedCompareExchange SetEvent ExitThread CreateEventW SetThreadIdealProcessor GetSystemInfo GetThreadPriority SuspendThread ResumeThread CreateThread HeapDestroy HeapCreate LocalSize GetTempFileNameW SetProcessAffinityMask SetEnvironmentVariableA GetExitCodeProcess GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation GetFileType GetFileAttributesExW InitializeSListHead GetOEMCP GetACP IsValidCodePage HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCPInfo RaiseException RtlUnwind GetCommandLineA GetSystemTimeAsFileTime GetThreadTimes DeleteFileA AreFileApisANSI GetModuleHandleExW HeapReAlloc IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetStringTypeW ExitProcess GetFullPathNameW LocalFree LocalLock LocalUnlock GetVolumeInformationW GetCurrentProcessId DeleteFileW RemoveDirectoryW GetTempPathW GetFileAttributesW CreateFileW GetTickCount CreateDirectoryW SetEndOfFile GetDriveTypeW SetFilePointer GetFileSize CloseHandle DuplicateHandle CreatePipe SetStdHandle GetStdHandle FlushFileBuffers GetModuleFileNameW ReadFile WriteFile GetCurrentProcess CreateProcessW FindNextFileW FindClose GetProcAddress LoadLibraryW FreeLibrary FindFirstFileW GetLastError GetModuleHandleW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetProcessHeap SetEnvironmentVariableW HeapCompact

user32

SetTimer ReleaseDC GetDC ChangeDisplaySettingsW MessageBoxW GetSysColor SetWindowPos GetParent GetWindowRect DefWindowProcW CreateWindowExW SetWindowLongW GetWindowLongW RegisterClassExW GetClassInfoExW PostMessageW DestroyWindow GetWindowThreadProcessId SendMessageW SystemParametersInfoW EnumDisplaySettingsW LoadCursorFromFileW PostQuitMessage KillTimer CloseClipboard GetPriorityClipboardFormat IsClipboardFormatAvailable GetClipboardData OpenClipboard SetClipboardData LoadStringW ClientToScreen SetWindowRgn SetCapture GetCursorPos EnumWindows GetFocus EnumDisplaySettingsExW SetFocus GetForegroundWindow GetKeyboardLayout SetCursorPos MonitorFromWindow DestroyCaret CreateCaret SetCaretPos EndPaint GetWindowTextLengthW GetSystemMenu ScreenToClient SetActiveWindow GetMessageExtraInfo GetKeyState TrackMouseEvent IsWindowEnabled GetClientRect BeginPaint SetPropW GetCapture GetMenu LoadIconW SetRect InvalidateRect GetWindowTextW GetMenuItemCount AdjustWindowRectEx ReleaseCapture IsWindowVisible UpdateWindow SetWindowTextW SetCursor LoadCursorW WindowFromPoint GetCursor DialogBoxParamW GetDlgItem EndDialog SetDlgItemTextW EnableWindow TranslateAcceleratorW DestroyAcceleratorTable IsIconic CreateAcceleratorTableW WaitMessage TranslateMessage LoadAcceleratorsW PeekMessageW ShowWindow DispatchMessageW GetAsyncKeyState GetSystemMetrics GetMonitorInfoW

gdi32

EnumFontFamiliesExW GetStockObject GetTextMetricsW CreateFontIndirectW SelectObject GetFontData DeleteObject GetObjectW ExtCreateRegion CreateRectRgn GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps CreateCompatibleDC CreateDIBSection EnumFontsW DeleteDC CreateDIBitmap GetPixel CombineRgn SetPixel CreateCompatibleBitmap

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetSpecialFolderPathW DragFinish SHGetPathFromIDListW ShellExecuteW DragQueryFileW DragAcceptFiles SHBrowseForFolderW

ole32

CLSIDFromString CoTaskMemFree CoCreateGuid CoTaskMemAlloc StringFromGUID2

winmm

timeEndPeriod timeGetTime timeGetDevCaps timeBeginPeriod

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

mpr

WNetGetUniversalNameW

shlwapi

PathIsDirectoryW PathFileExistsW

imm32

ImmGetContext ImmGetOpenStatus ImmIsIME ImmSetCompositionFontW ImmSetConversionStatus ImmSetOpenStatus ImmAssociateContext ImmGetConversionStatus ImmSetCompositionWindow ImmReleaseContext

dbghelp

MiniDumpWriteDump

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.adata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

699KB

Virtual Size

698KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

653KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

210KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Tsumugi.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winmm

version

mpr

shlwapi

imm32

dbghelp

generic