Private_External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Private_External.exe
Size 4.0MB
Sample260817-afsntazdpd
SHA256 e40c7c2922525090be8117712654ce91ec9a477dfe3978c6dcf8312a53f0c094
MD5 08277ea6d899282986df90b84cb294f8
SHA1 0a6495475207a55cc7c451df2c90370d7df30f9c
SHA512 02a4e539e4336ea27b2ec9f65fe992413aeb612fd28eb2fcadbc1dcf93045a72abe3b115d97aa212bae357d16b286f355dfea438aa8fa5411df14c55d53836d1
SSDEEP 49152:UY/D2ECrAxKKteoNTiz4zKq78yGXVhFBmRcq3RhX373BzCI4jNWIJkP0yZ8:v/D2+twO+FhWRTTBzCI4jNWIJy2
TLSH
T1FA166B0992AF069CC1A6D478C6279217E2F7BC0913724FD752D04EE52F2B9D9773AE02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Private_External.exe

File Explorer

Private_External.exe

.exe 4.0MB

Private_External.exe

IMPHASH 5f5498c4a0c56ba0134b0eb0f7278c06
SHA256 e40c7c2922525090be8117712654ce91ec9a477dfe3978c6dcf8312a53f0c094
MD5 08277ea6d899282986df90b84cb294f8
SHA1 0a6495475207a55cc7c451df2c90370d7df30f9c
SHA512 02a4e539e4336ea27b2ec9f65fe992413aeb612fd28eb2fcadbc1dcf93045a72abe3b115d97aa212bae357d16b286f355dfea438aa8fa5411df14c55d53836d1
SSDEEP 49152:UY/D2ECrAxKKteoNTiz4zKq78yGXVhFBmRcq3RhX373BzCI4jNWIJkP0yZ8:v/D2+twO+FhWRTTBzCI4jNWIJy2
TLSH
T1FA166B0992AF069CC1A6D478C6279217E2F7BC0913724FD752D04EE52F2B9D9773AE02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3539408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Downloads\axeprime\bin\Private_External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ws2_32

WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo setsockopt sendto ioctlsocket gethostname WSACleanup bind connect getpeername getsockname htons WSAStartup recv inet_ntop socket recvfrom WSASetLastError ntohs inet_pton WSAGetLastError closesocket getsockopt WSAWaitForMultipleEvents send WSACloseEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

crypt32

CertGetNameStringW CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertOpenStore CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptSetProperty BCryptGenRandom BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData

kernel32

SleepConditionVariableSRW GetCurrentThreadId GetFileInformationByHandleEx AreFileApisANSI CreateFile2 InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable GetFileAttributesExA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime WriteProcessMemory ReadProcessMemory OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW WideCharToMultiByte Module32NextW VirtualQueryEx GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree FormatMessageA GlobalUnlock GetProcessId K32EnumDeviceDrivers GetModuleFileNameA QueryDosDeviceW VirtualProtect SetLastError SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW GetVolumeInformationA CreateFileW Sleep GetLastError K32GetModuleBaseNameW K32GetDeviceDriverBaseNameW GetCurrentThread FreeConsole CreateThread SetFileAttributesA LocalFree ExitProcess GetCurrentProcessId CreateProcessW SetThreadExecutionState GetModuleHandleW QueryFullProcessImageNameW K32EnumProcessModules CreateDirectoryA GetTickCount GetConsoleWindow SetThreadAffinityMask SetThreadPriority CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GlobalLock SetFileInformationByHandle

user32

MapVirtualKeyW keybd_event mouse_event SendInput SendMessageW SetWindowDisplayAffinity SetWindowLongW GetWindowLongW GetWindowThreadProcessId DefWindowProcW PostMessageW DestroyWindow IsWindowVisible CreateWindowExW GetAsyncKeyState UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW EnumWindows SetLayeredWindowAttributes TranslateMessage FindWindowW PostQuitMessage GetParent UpdateWindow GetWindowTextW GetSystemMetrics CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetDC ReleaseDC FindWindowA OpenClipboard

gdi32

GetPixel

advapi32

CryptCreateHash CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData GetTokenInformation RegOpenKeyExA CheckTokenMembership FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA AllocateAndInitializeSid RegQueryValueExA ConvertSidToStringSidA GetCurrentHwProfileA RegCloseKey CryptReleaseContext CryptAcquireContextW CryptGetHashParam

shell32

ShellExecuteA ShellExecuteExW

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_yield ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??Bios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Xtime_get_ticks ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_counter ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Query_perf_frequency ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

timeBeginPeriod timeEndPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context wcschr memcmp memchr memset __current_exception memmove memcpy longjmp strrchr __RTtypeid __std_type_info_compare wcsstr __C_specific_handler strchr strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _configure_wide_argv _initterm _initterm_e _exit _set_app_type _seh_filter_exe _get_wide_winmain_command_line _cexit exit __sys_errlist __sys_nerr _c_exit _register_thread_local_exe_atexit_callback _wassert _crt_atexit _register_onexit_function system abort _beginthreadex terminate _errno _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fflush fclose _wopen __stdio_common_vsprintf_s fgetc feof fputs fwrite __stdio_common_vsprintf fgetpos setvbuf ungetc _set_fmode freopen_s _popen fgets fsetpos __p__commode fread _pclose _read _write _fseeki64 _fileno _close _get_stream_buffer_pointers __stdio_common_vsscanf ftell _wfopen __stdio_common_vfprintf fseek __acrt_iob_func fputc

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode calloc free malloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtol wcstombs strtoll strtof strtod atoi

api-ms-win-crt-math-l1-1-0

roundf sinf ceilf _fdopen ceil _dsign sqrtf fmodf cosf asinf acosf __setusermatherr powf

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink remove _lock_file _unlock_file _fstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_collate_cp_func localeconv ___lc_codepage_func ___lc_locale_name_func

api-ms-win-crt-string-l1-1-0

isxdigit isspace tolower wcsncpy _wcsicmp _strdup isalnum strncpy strcmp strncmp _wcsdup strcspn wcspbrk strspn wcsncmp strpbrk _stricmp strlen wcslen

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _time64 _localtime64_s _mktime64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv