poc62215[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
poc62215.exe
Size 142KB
Sample260816-2e5qjaydpa
SHA256 9fdf7f77af0b145d415592c78ba4479bc2365fcc8db1ec0d6a9d7277932dd9a6
MD5 f46cd083a35b1e00b2b5fb7d1dd9b5f7
SHA1 e728bb302dea194b1a863ecd2440c38e20c18b55
SHA512 fd777ec3cebe90dafe8bbc76c3c1d12ce327cae575412334a4ece6ed18a4f9e761a2d06d6ff2c78c0392c046f9b7f57c51a228f82b2565d6bde652494befb1ef
SSDEEP 1536:1aH9VELsL7WRi2nkj82XSDl6i471MYRuw6OwypuCE2vpBLrn19vgKvDH2aOAVhiH:u9Ve4if2iDMT9zNzH2aOAycfLbFhs8U
TLSH
T1B4E32AC1BBC6ACE7CA12623854A68325233CFBD5578697030D3972351F23AC1AED765B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
poc62215.exe

File Explorer

poc62215.exe

.exe 142KB

poc62215.exe

IMPHASH ecce1fa30748a6984c6ea7e9e085955b
SHA256 9fdf7f77af0b145d415592c78ba4479bc2365fcc8db1ec0d6a9d7277932dd9a6
MD5 f46cd083a35b1e00b2b5fb7d1dd9b5f7
SHA1 e728bb302dea194b1a863ecd2440c38e20c18b55
SHA512 fd777ec3cebe90dafe8bbc76c3c1d12ce327cae575412334a4ece6ed18a4f9e761a2d06d6ff2c78c0392c046f9b7f57c51a228f82b2565d6bde652494befb1ef
SSDEEP 1536:1aH9VELsL7WRi2nkj82XSDl6i471MYRuw6OwypuCE2vpBLrn19vgKvDH2aOAVhiH:u9Ve4if2iDMT9zNzH2aOAycfLbFhs8U
TLSH
T1B4E32AC1BBC6ACE7CA12623854A68325233CFBD5578697030D3972351F23AC1AED765B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation OpenProcessToken

libgcc_s_seh-1

_Unwind_Resume

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress InitializeCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualProtect VirtualQuery WaitForMultipleObjects

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _initterm atexit abort calloc exit fflush fprintf free malloc memcmp memcpy memset setvbuf signal strlen strncmp vfprintf

libstdc++-6

_ZNKSt5ctypeIcE13_M_widen_initEv _ZNSo3putEc _ZNSo5flushEv _ZNSo9_M_insertIyEERSoT_ _ZNSolsEi _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy _ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x _ZSt16__throw_bad_castv _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt4cerr _ZSt4cout _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_ _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc _ZdlPvy _Znwy __gxx_personality_seh0

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

743B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

512B

Virtual Size

396B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

poc62215.exe

advapi32

libgcc_s_seh-1

kernel32

msvcrt

libstdc++-6

generic