mapper (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mapper (1).exe
Size 143KB
Sample260815-ch22dadc86
SHA256 88806ce4d1dfde3bd34b807d6dde5b6bfe4f5b8bc3a63c19b572e71aab644102
MD5 6233c9438a22652a6aca3b376f81695c
SHA1 e10ed9ec3f6449f547e760a1ac6563e9cf3204dd
SHA512 dc680b11e010784cc5972f73fc705891b9cdbad2ba3e316336638a64095b258e6a8b8f1b9aaa5feab5dca3c24a628fe2071894fa3acd1caf261144bcba9a62fc
SSDEEP 1536:szRuyAaUcQej+TGnrhcqA6ZjVX7U1/4GAjF7ak4FKSLIuiYmQAoe:sHN+TGqKZVX7aAjF7ak4MXU
TLSH
T11DE33C16A7A51069E2B6DAB8CEA14502FB727C414B78D7CF075049B90F32BD07F3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mapper (1).exe

File Explorer

mapper (1).exe

.exe 143KB

mapper (1).exe

IMPHASH 7156fe31464be3accd1d42564a61316b
SHA256 88806ce4d1dfde3bd34b807d6dde5b6bfe4f5b8bc3a63c19b572e71aab644102
MD5 6233c9438a22652a6aca3b376f81695c
SHA1 e10ed9ec3f6449f547e760a1ac6563e9cf3204dd
SHA512 dc680b11e010784cc5972f73fc705891b9cdbad2ba3e316336638a64095b258e6a8b8f1b9aaa5feab5dca3c24a628fe2071894fa3acd1caf261144bcba9a62fc
SSDEEP 1536:szRuyAaUcQej+TGnrhcqA6ZjVX7U1/4GAjF7ak4FKSLIuiYmQAoe:sHN+TGqKZVX7aAjF7ak4MXU
TLSH
T11DE33C16A7A51069E2B6DAB8CEA14502FB727C414B78D7CF075049B90F32BD07F3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\yazz\Downloads\RTCore64\x64\Release\RTCore64_Vulnerability.pdb

kernel32

GetCurrentThreadId GetModuleHandleA OpenProcess GetLastError CreateFileA GetSystemDirectoryA LoadLibraryA DeleteFileA CloseHandle GetProcAddress GetCurrentProcessId CreateFileW DeviceIoControl CreateToolhelp32Snapshot Process32NextW Process32FirstW SetUnhandledExceptionFilter GetTempPathW GetModuleHandleW FormatMessageA GetLocaleInfoEx VirtualAlloc VirtualFree SetLastError GetFileAttributesExA CreateDirectoryA GetModuleFileNameA InitializeSListHead GetSystemTimeAsFileTime FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter LocalFree

user32

GetShellWindow GetWindowThreadProcessId

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

ole32

StringFromGUID2

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

ntdll

RtlAdjustPrivilege NtQuerySystemInformation NtUnloadDriver NtLoadDriver RtlInitUnicodeString

dbghelp

SymCleanup SymLoadModuleEx SymUnloadModule64 SymSetOptions SymInitialize SymFromName

urlmon

URLDownloadToFileA

shlwapi

PathFileExistsA PathRemoveFileSpecA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_terminate memcmp __std_exception_copy __std_exception_destroy memcpy memset _CxxThrowException memmove __current_exception_context __current_exception wcsstr

api-ms-win-crt-convert-l1-1-0

_itoa_s wcstombs_s

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread fsetpos __acrt_iob_func ungetc __stdio_common_vfprintf _set_fmode fputc setvbuf fgetpos __stdio_common_vsprintf fwrite _get_stream_buffer_pointers __p__commode fgetc fflush fclose

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment _initterm _initterm_e exit _exit _initialize_wide_environment __p___argc __p___wargv _configure_wide_argv _register_thread_local_exe_atexit_callback _set_app_type _invoke_watson terminate _crt_atexit abort _initialize_onexit_table _seh_filter_exe _c_exit _cexit _register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

_wremove _unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr