PopCornFN[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PopCornFN.exe
Size 33.8MB
Sample260818-bj2xbstbrd
SHA256 644005de6cb57987527ce50098a3a3a97e5bfffccff2ba29e56ccb695d430990
MD5 c0863fbf38ecb37345541f79e0a11305
SHA1 ad18f6bd14e7690c5b8074fc984ec8abe545f9fd
SHA512 41a8f4ade16dc339f375a8f5b7d5018dd9f2542a76b6d117cfac4d5868f8e14d04aa0ede71f37a42738819f5bc070e65b820fb695bd29907ca0ca1fd2c9fde99
SSDEEP 786432:fnCm0HrxDg01qcAU50Iowg1Negj3+4MpvtMPEl:fnC9Hra01qcB0VNegjdMpvcEl
TLSH
T10D773346D1B51296F9DAA03985668763F732BC9013104ACF27B87F713FB31E2193A7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PopCornFN.exe

File Explorer

PopCornFN.exe

.exe 33.8MB
main.pyc

19KB

PopCornFN.exe

IMPHASH 3cd73ad772c251b75dee63ad9187faae
SHA256 644005de6cb57987527ce50098a3a3a97e5bfffccff2ba29e56ccb695d430990
MD5 c0863fbf38ecb37345541f79e0a11305
SHA1 ad18f6bd14e7690c5b8074fc984ec8abe545f9fd
SHA512 41a8f4ade16dc339f375a8f5b7d5018dd9f2542a76b6d117cfac4d5868f8e14d04aa0ede71f37a42738819f5bc070e65b820fb695bd29907ca0ca1fd2c9fde99
SSDEEP 786432:fnCm0HrxDg01qcAU50Iowg1Negj3+4MpvtMPEl:fnC9Hra01qcB0VNegjdMpvcEl
TLSH
T10D773346D1B51296F9DAA03985668763F732BC9013104ACF27B87F713FB31E2193A7A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\indom\Downloads\green apple\green apple\red hat\x64\Release\red hat.pdb

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

ws2_32

recvfrom WSAIoctl sendto gethostname ntohl getsockopt getsockname freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup getpeername WSASetLastError socket setsockopt ntohs htons connect WSAGetLastError send recv closesocket bind

wldap32

ord301 ord200 ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30

crypt32

CertCloseStore CryptDecodeObjectEx CertFindCertificateInStore CryptStringToBinaryA PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertOpenStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertFreeCertificateContext

normaliz

IdnToAscii

kernel32

GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FormatMessageA SetLastError GetTickCount GetFileType ReadFile WaitForMultipleObjects CreateFileA GetFileSizeEx AcquireSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable ReleaseSRWLockExclusive PeekNamedPipe TerminateJobObject CreateProcessA WinExec MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary VerifyVersionInfoW QueryPerformanceCounter SizeofResource GetProcessId FindResourceA Sleep GetTempPathA GetLastError LockResource CloseHandle LoadResource

user32

SetWindowRgn GetWindowRect DispatchMessageA PostQuitMessage GetSystemMetrics MessageBoxA TranslateMessage SetClipboardData LoadIconA EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos IsIconic SetForegroundWindow ReleaseCapture RegisterClassExA PeekMessageA GetClipboardData UnregisterClassA GetClientRect SetWindowLongW SetCursor SetCapture BringWindowToTop SetFocus SetLayeredWindowAttributes CreateWindowExA GetDesktopWindow UpdateWindow DefWindowProcA GetWindowLongW AdjustWindowRectEx GetKeyState LoadCursorA DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors ScreenToClient SetWindowTextW WindowFromPoint ShowWindow GetCapture SetWindowLongA ClientToScreen IsChild GetMonitorInfoA GetForegroundWindow

gdi32

GetDeviceCaps CreateRoundRectRgn

advapi32

CryptDestroyKey CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptImportKey CryptEncrypt CryptAcquireContextA

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmSetWindowAttribute

msvcp140

?_Xbad_alloc@std@@YAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0_Lockit@std@@QEAA@H@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z

d3d9

Direct3DCreate9

winmm

mciSendStringA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr _CxxThrowException __C_specific_handler __current_exception_context __current_exception memchr memcmp memmove strrchr memset memcpy __std_exception_copy __std_exception_destroy strchr

api-ms-win-crt-stdio-l1-1-0

fwrite fgetc _lseeki64 fgetpos fgets setvbuf ungetc fputc ftell fsetpos fseek __acrt_iob_func _fseeki64 _get_stream_buffer_pointers feof fflush _set_fmode fputs fopen __stdio_common_vsscanf fread __p__commode __stdio_common_vsprintf _wfopen fclose _read _write _close _open

api-ms-win-crt-string-l1-1-0

_strdup isupper strspn strcmp strpbrk tolower strncmp strncpy strcspn strlen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh realloc free malloc calloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi strtoll strtol strtoul

api-ms-win-crt-runtime-l1-1-0

__sys_nerr _errno strerror _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _getpid _initialize_narrow_environment _configure_narrow_argv _beginthreadex

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_unlink _stat64 _lock_file _unlock_file _access _fstat64

api-ms-win-crt-math-l1-1-0

acosf sinf cosf ceilf fmodf sqrtf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale