Skaza[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Skaza.exe
Size 875KB
Sample260816-ef52cszves
SHA256 a051f189bbdb9c057e6f069441032cc251642ee4b02e9df20e19be2b537bbf4c
MD5 04ed23503fbdddfe4a790bdd4450314a
SHA1 b7208e7ca8a2f04836112516fcaeb9e70cea79b4
SHA512 42c2bb773c68de8d1ce0da2aa05c2daac091feb1c08a7e635c4686fd0ff8f812868f7ed05fb4ae65a37a42db5b7512a8204f3ec267dc96285b7d84cf40dc2c4a
SSDEEP 24576:bTFyJXXCmWl/Dob17Q8JNjlyoyGW+rQ9nJvxq:FsHCmpzPpd1rmnJI
TLSH
T11E159E5AA3E801FAD46B903C9557A707F6B2745A03109BCB13E089793F73BE05EBA711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Skaza.exe

File Explorer

Skaza.exe

.exe 875KB

Skaza.exe

IMPHASH c43e641a51ba97265d9c67c490708bf2
SHA256 a051f189bbdb9c057e6f069441032cc251642ee4b02e9df20e19be2b537bbf4c
MD5 04ed23503fbdddfe4a790bdd4450314a
SHA1 b7208e7ca8a2f04836112516fcaeb9e70cea79b4
SHA512 42c2bb773c68de8d1ce0da2aa05c2daac091feb1c08a7e635c4686fd0ff8f812868f7ed05fb4ae65a37a42db5b7512a8204f3ec267dc96285b7d84cf40dc2c4a
SSDEEP 24576:bTFyJXXCmWl/Dob17Q8JNjlyoyGW+rQ9nJvxq:FsHCmpzPpd1rmnJI
TLSH
T11E159E5AA3E801FAD46B903C9557A707F6B2745A03109BCB13E089793F73BE05EBA711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

694580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA SetLastError GetModuleHandleW SleepEx VerSetConditionMask GetSystemDirectoryA FreeLibrary LoadLibraryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx WideCharToMultiByte GetModuleHandleA GetModuleFileNameW MultiByteToWideChar GetTickCount CreateThread GetModuleFileNameA GetFileType UnmapViewOfFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentThreadId GetSystemTimeAsFileTime MapViewOfFile CreateFileMappingW VirtualProtect GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError Process32NextW Process32FirstW CreateToolhelp32Snapshot InitializeSListHead OutputDebugStringW CloseHandle Beep GetStdHandle Sleep QueryPerformanceFrequency QueryPerformanceCounter CreateFileW GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryW GetProcAddress GetConsoleWindow SetConsoleTextAttribute ReadFile GetConsoleScreenBufferInfo VirtualFree VirtualAlloc GetCurrentProcessId GetEnvironmentVariableA

user32

GetForegroundWindow UpdateWindow GetSystemMetrics FindWindowA GetWindow GetWindowRect GetWindowLongW GetAsyncKeyState SetWindowDisplayAffinity SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExW UnregisterClassW SetWindowLongW MessageBoxA RegisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseCapture SetCapture GetCapture GetKeyState GetActiveWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard

gdi32

GetStockObject

advapi32

CryptEncrypt CryptImportKey CryptCreateHash CryptDestroyHash CryptDestroyKey CryptGetHashParam CryptAcquireContextA ConvertSidToStringSidA CopySid SetSecurityInfo GetUserNameA IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce OpenProcessToken CryptGenRandom CryptReleaseContext CryptHashData

shell32

ShellExecuteA

msvcp140

??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@D@std@@2V0locale@2@A ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3d9

Direct3DCreate9Ex

normaliz

IdnToAscii

wldap32

ord46 ord217 ord211 ord143 ord41 ord32 ord60 ord26 ord33 ord45 ord35 ord79 ord27 ord50 ord30 ord301 ord200 ord22

crypt32

CertFreeCertificateChainEngine CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain

ws2_32

getsockname htons ntohs bind setsockopt ntohl gethostname sendto recvfrom freeaddrinfo connect getaddrinfo WSAGetLastError select __WSAFDIsSet ioctlsocket listen getsockopt htonl accept WSACleanup closesocket WSAStartup getpeername send WSAIoctl WSASetLastError socket recv

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__std_exception_copy __std_exception_destroy memcpy memmove memset __std_terminate strstr __current_exception_context __current_exception memchr memcmp __C_specific_handler strchr _CxxThrowException strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _register_onexit_function _set_app_type _get_initial_narrow_environment _initialize_onexit_table _initialize_narrow_environment _invalid_parameter_noinfo_noreturn _configure_narrow_argv terminate _getpid exit _beginthreadex _initterm _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _resetstkoflw _invalid_parameter_noinfo __sys_nerr strerror __p___argv __p___argc _exit _initterm_e _errno abort

api-ms-win-crt-string-l1-1-0

strcmp strncpy _stricmp _wcsicmp _strdup isupper strspn strcspn strncmp strpbrk tolower isprint

api-ms-win-crt-stdio-l1-1-0

_pclose _popen fputc fopen feof __stdio_common_vsprintf_s _lseeki64 __acrt_iob_func _wfopen fgets _open _close _write _read __p__commode fclose _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fwrite ftell fseek fread fflush fputs

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode calloc malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

_dclass atan2 fmodf ceilf fmod powf __setusermatherr cosf floorf sinf sqrtf atan2f pow tanf asin

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtoll strtol atof atoi strtod

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _access _unlink _stat64