SimpleM[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SimpleM.exe
Size 1.8MB
Sample260815-eewfjaybqh
SHA256 701f93cab6eb406ec3ac0313356bbbef5401b35083cc31a08b1d873eea49a52b
MD5 88e584dbcd058264c6dc93dbe7854f6e
SHA1 3792a27cf55b53aaaee0018f8c60506a3cdc3ab5
SHA512 0cb24cf6cebc8dedef9a82fe7416110a72267296eeb38f3f44ce882b0b14add70c9f7b9dfd7533dc18c5a18838ea6311f7b81dd46ddf32e3e79ff19d694ec56d
SSDEEP 24576:TfZ1Egqm0g9b6fcCjuYqtgmvCVeMZilbnOHt7s/F638Eu/xPHEatpm:TfZag7L9b6feYqUylbnQsEr
TLSH
T14D859D87B3EA8599D037A478CB42550BE6727424077082EB7FD51A5A9FBF5E0CB3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SimpleM.exe

File Explorer

SimpleM.exe

.exe 1.8MB

SimpleM.exe

IMPHASH 2801c79ffc86c0b3541bc114c051abcc
SHA256 701f93cab6eb406ec3ac0313356bbbef5401b35083cc31a08b1d873eea49a52b
MD5 88e584dbcd058264c6dc93dbe7854f6e
SHA1 3792a27cf55b53aaaee0018f8c60506a3cdc3ab5
SHA512 0cb24cf6cebc8dedef9a82fe7416110a72267296eeb38f3f44ce882b0b14add70c9f7b9dfd7533dc18c5a18838ea6311f7b81dd46ddf32e3e79ff19d694ec56d
SSDEEP 24576:TfZ1Egqm0g9b6fcCjuYqtgmvCVeMZilbnOHt7s/F638Eu/xPHEatpm:TfZag7L9b6feYqUylbnQsEr
TLSH
T14D859D87B3EA8599D037A478CB42550BE6727424077082EB7FD51A5A9FBF5E0CB3A700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

694820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\-\Desktop\Source\x64\Release\upx_fivem.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetCommandLineA GetLastError GetStartupInfoA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA CreateMutexA ReleaseMutex GetConsoleWindow SetUnhandledExceptionFilter WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleA GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType HeapAlloc HeapFree GetCommandLineW WriteFile GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead OutputDebugStringA VirtualFreeEx CreateRemoteThread VirtualAllocEx Sleep Process32Next K32GetModuleFileNameExA Module32First Module32Next Process32First VirtualQueryEx FreeLibrary CreateProcessW ReadProcessMemory ExitProcess LocalFree GetProcAddress GetSystemInfo CloseHandle Process32FirstW LoadLibraryA Process32NextW CreateToolhelp32Snapshot OpenProcess GetModuleFileNameW GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer RtlUnwind GetCurrentProcess WriteProcessMemory SetEndOfFile GetConsoleMode DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx GetStringTypeW InitOnceComplete InitOnceBeginInitialize InitializeCriticalSectionEx GetSystemTimeAsFileTime

user32

SetForegroundWindow UpdateWindow FindWindowA PostQuitMessage SendInput AppendMenuW SystemParametersInfoA LoadIconA SetCursor TranslateMessage GetCursorPos GetAsyncKeyState GetForegroundWindow GetWindowLongPtrA EmptyClipboard SetLayeredWindowAttributes GetWindowThreadProcessId GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard DestroyMenu GetClipboardData SetClipboardData DispatchMessageA GetWindowRect LoadCursorA DestroyWindow PostMessageA CallNextHookEx UnregisterClassW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow SetWindowLongA SetWindowsHookExA PeekMessageW SetWindowDisplayAffinity MessageBoxA MoveWindow UnhookWindowsHookEx DefWindowProcA SetFocus

advapi32

AdjustTokenPrivileges QueryServiceStatusEx OpenServiceW RegDeleteValueW ConvertSidToStringSidW GetTokenInformation RegOpenKeyExW RevertToSelf CreateProcessAsUserA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx LookupPrivilegeValueW OpenProcessToken RegCloseKey CloseServiceHandle OpenSCManagerW RegEnumValueW

shell32

SHGetFolderPathW Shell_NotifyIconW ShellExecuteA SHEmptyRecycleBinW

ole32

CoInitializeEx

d3dx9_43

D3DXMatrixTranspose

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

wevtapi

EvtClose EvtOpenLog EvtClearLog

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

904KB

Virtual Size

904KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

648KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SimpleM.exe

d3d11

d3dcompiler_47

kernel32

user32

advapi32

shell32

ole32

d3dx9_43

ntdll

wevtapi

imm32

dwmapi

generic