shiftx emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
shiftx emu.exe
Size 13.5MB
Sample260816-wrd6fstfqa
SHA256 a23feb2e63a675c3f7ca99e7d167dfaae911443f7c2f5f548fa80695587f97ce
MD5 2e87b10287cacf62dacd85ab4f441fc5
SHA1 a22aaebb0f72ba1734b174b41e11760d535fe970
SHA512 fc5f4b67e300873074c6c7972fe21cb1ce607d1a750408647949bc0a3f0f8ab8bbff3ea36e6191414841aa284ed757824e3ec94fc64364411af86a7239736701
SSDEEP 393216:KWUEKtquY8TLJ1gqas6ck1CPwDvt3uFKCyMJcsi5aYs:KWUJrVV
TLSH
T136E6CF6AA7BC0149E4AAD1BCC2979327D771B81527B053CF5A5046F81F23BE52B7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shiftx emu.exe

File Explorer

shiftx emu.exe

.exe 13.5MB

shiftx emu.exe

IMPHASH 5bd17a439f099dc9ec54239e9f65bce2
SHA256 a23feb2e63a675c3f7ca99e7d167dfaae911443f7c2f5f548fa80695587f97ce
MD5 2e87b10287cacf62dacd85ab4f441fc5
SHA1 a22aaebb0f72ba1734b174b41e11760d535fe970
SHA512 fc5f4b67e300873074c6c7972fe21cb1ce607d1a750408647949bc0a3f0f8ab8bbff3ea36e6191414841aa284ed757824e3ec94fc64364411af86a7239736701
SSDEEP 393216:KWUEKtquY8TLJ1gqas6ck1CPwDvt3uFKCyMJcsi5aYs:KWUJrVV
TLSH
T136E6CF6AA7BC0149E4AAD1BCC2979327D771B81527B053CF5A5046F81F23BE52B7E380
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

622160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libcrypto-4-x64

EVP_EncryptUpdate EVP_DigestFinal EVP_sha1 EVP_DigestInit EVP_MD_CTX_new EVP_md5 EVP_DigestUpdate EVP_MD_CTX_free EVP_DigestInit_ex EVP_DigestFinal_ex BIO_push BIO_f_base64 BIO_read EVP_CIPHER_CTX_free BIO_free_all RAND_bytes BIO_write EVP_PKEY_set1_RSA EVP_CIPHER_CTX_new PEM_read_bio_RSAPublicKey EVP_PKEY_decrypt_init EVP_PKEY_encrypt_init BIO_new EVP_PKEY_decrypt BIO_ctrl EVP_PKEY_CTX_set_rsa_mgf1_md EVP_DecryptUpdate EVP_PKEY_CTX_free EVP_PKEY_new EVP_PKEY_CTX_set_rsa_padding EVP_DecryptFinal_ex RSA_free EVP_Digest PEM_read_bio_PUBKEY BIO_set_flags EVP_EncryptInit_ex EVP_sha256 EVP_PKEY_get_size EVP_DecryptInit_ex EVP_PKEY_CTX_set_rsa_oaep_md BIO_s_mem PEM_read_bio_PrivateKey d2i_RSA_PUBKEY EVP_PKEY_encrypt EVP_PKEY_free BIO_free EVP_EncryptFinal_ex EVP_sha512 EVP_CIPHER_CTX_ctrl d2i_PUBKEY PEM_write_bio_PUBKEY BIO_new_mem_buf EVP_PKEY_CTX_new d2i_RSAPublicKey EVP_aes_256_gcm

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpSetOption WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

shlwapi

PathRemoveFileSpecW PathRemoveFileSpecA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

SetUnhandledExceptionFilter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GlobalUnlock FreeLibrary GetModuleHandleW GlobalLock GlobalFree GlobalAlloc CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter K32EnumProcessModules GetCurrentProcessId ExitProcess K32GetModuleBaseNameA QueryPerformanceFrequency SetDllDirectoryA QueryFullProcessImageNameA SetFileInformationByHandle K32GetModuleFileNameExA FindClose FindNextFileA GetModuleFileNameW FindFirstFileA ConnectNamedPipe CreateNamedPipeA ReadFile CreateDirectoryA CreateProcessA GetProcAddress GetLocalTime LoadResource LockResource LoadLibraryA CreateFileA GetFileAttributesA GetLastError OpenProcess GetModuleHandleA CreateMutexA FindResourceA TerminateProcess WriteFile GetFileAttributesExA InitializeSListHead VerSetConditionMask SizeofResource SetFileAttributesA DeleteFileA GetTickCount64 LocalFree Sleep Beep Process32First CreateToolhelp32Snapshot Process32Next CloseHandle GetUserDefaultLocaleName WideCharToMultiByte GetModuleFileNameA GetCurrentProcess MultiByteToWideChar

user32

DefWindowProcW GetKeyState DispatchMessageA GetWindowRect LoadCursorA DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetCapture SetWindowLongA ClientToScreen CloseClipboard EmptyClipboard GetWindowLongA GetForegroundWindow MoveWindow SetLayeredWindowAttributes TranslateMessage GetClipboardData SetCapture SetClipboardData SetCursor GetClientRect PeekMessageA PostQuitMessage SetProcessDPIAware IsWindowUnicode UpdateWindow ReleaseCapture SetForegroundWindow SetCursorPos GetCursorPos GetWindowThreadProcessId IsWindowVisible GetWindowTextA EnumWindows MessageBoxA GetAsyncKeyState TrackMouseEvent OpenClipboard

gdi32

CreateRoundRectRgn

advapi32

ConvertSidToStringSidA CloseServiceHandle OpenProcessToken OpenServiceA ControlService OpenSCManagerA StartServiceA RegCloseKey RegQueryValueExA RegOpenKeyExA QueryServiceStatus GetTokenInformation

shell32

ShellExecuteExA SHGetFolderPathA

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ __crtLCMapStringA _Xtime_get_ticks _Thrd_join _Thrd_id ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

imm32

ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr memcpy memmove _CxxThrowException __current_exception_context __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate __std_type_info_compare __RTtypeid strrchr strstr memset memchr memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode ungetc _set_fmode _wfopen __stdio_common_vsscanf fseek ftell fgets fopen fwrite __stdio_common_vsprintf _get_stream_buffer_pointers _fseeki64 fread fgetpos fsetpos fputc __acrt_iob_func fflush fclose fgetc setvbuf

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe _crt_atexit _set_app_type _errno _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _register_onexit_function terminate system _initialize_narrow_environment _beginthreadex

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp isalnum _stricmp tolower wcslen strncpy

api-ms-win-crt-convert-l1-1-0

strtoll strtol atoi

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc realloc _set_new_mode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

fmodf ceilf cosf pow powf ldexp sinf __setusermatherr acosf sqrtf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func