unheard[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unheard.exe
Size 551KB
Sample260818-bcb3bsck2v
SHA256 b9caa847ecaafd270b7de784679ce08e3c1202432888b8f49c25105a48913bfa
MD5 e39d6022c75807f15396415d5e4a97a8
SHA1 17c4a3152dd254057daa283653fd9f0782fbe1e9
SHA512 f377ddd53204729672e1b2a145bf9a976f5c5aa9721129b6b1b29e494d2ab9441402931605c16f2a460ad9bb05cda84c6b5838c264ca8902f5819615e1549bb3
SSDEEP 12288:Kd3hjTqA3ko8yCVAyq4nsDib33WAnJwtYj2z:Y3l3koluAyq4nsDi6AnJwtzz
TLSH
T146C4B081F1A950ECD0179138CB56AE0FEA3A3444172019CB77D4D9B82BB3BF867BA711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unheard.exe

File Explorer

unheard.exe

.exe 551KB

unheard.exe

IMPHASH c93129eaadf6d4d877d9f688a0491b0a
SHA256 b9caa847ecaafd270b7de784679ce08e3c1202432888b8f49c25105a48913bfa
MD5 e39d6022c75807f15396415d5e4a97a8
SHA1 17c4a3152dd254057daa283653fd9f0782fbe1e9
SHA512 f377ddd53204729672e1b2a145bf9a976f5c5aa9721129b6b1b29e494d2ab9441402931605c16f2a460ad9bb05cda84c6b5838c264ca8902f5819615e1549bb3
SSDEEP 12288:Kd3hjTqA3ko8yCVAyq4nsDib33WAnJwtYj2z:Y3l3koluAyq4nsDi6AnJwtzz
TLSH
T146C4B081F1A950ECD0179138CB56AE0FEA3A3444172019CB77D4D9B82BB3BF867BA711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zackk\Downloads\uheard\x64\Release\unheard.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetLastError GetLastError GetModuleHandleW DeviceIoControl SetThreadPriority GetCurrentThread CreateFileW CreateToolhelp32Snapshot Sleep GlobalFree CloseHandle SetConsoleOutputCP GlobalAlloc GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar OutputDebugStringA GetLocaleInfoA GlobalUnlock WideCharToMultiByte Process32FirstW GlobalLock WakeAllConditionVariable Process32NextW SetUnhandledExceptionFilter

user32

GetWindowThreadProcessId DestroyWindow CreateWindowExW GetSystemMetrics ShowWindow EnumWindows SetLayeredWindowAttributes LoadCursorW RegisterClassExW GetAsyncKeyState DefWindowProcW GetKeyState GetMessageExtraInfo ToUnicode ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetKeyboardState SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos LoadCursorA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event DispatchMessageA MapVirtualKeyW PeekMessageA TranslateMessage GetWindowRect SetFocus SetWindowLongA GetWindowLongA SetWindowPos

shell32

ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ _Mtx_unlock _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_hardware_concurrency _Unlock_shared_ptr_spin_lock _Lock_shared_ptr_spin_lock ?good@ios_base@std@@QEBA_NXZ _Query_perf_counter _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memcmp memcpy memmove __C_specific_handler __current_exception __current_exception_context _CxxThrowException __std_exception_copy memset __std_exception_destroy __std_terminate

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-stdio-l1-1-0

fclose _set_fmode ftell __stdio_common_vsprintf_s __stdio_common_vfprintf fseek __p__commode fflush __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

tolower strcmp _stricmp strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type system _get_initial_narrow_environment _initterm _initterm_e exit _exit _beginthreadex __p___argc __p___argv _c_exit terminate _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

acosf ceilf sqrtf sinf fmodf cosf __setusermatherr _fdclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale