layuh[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
layuh.exe
Size 2.5MB
Sample260819-vrnt8ayfle
SHA256 ff478544cdfdfc21247c5f4b8b55c555120d91d1235bf3771617ee79276740a6
MD5 c90589cdece602f2082779b1d545dd6c
SHA1 2be0987aba1bd7625ba46bf6cac2127a02e0720f
SHA512 14845fcc6bc4be0b3b94145f3605c663e551915237f5fb4829b28b0a6b5fe466344026792b798b4facf5456848cbe32d2f2c32689951de4911f060d9b1939944
SSDEEP 49152:+BaFLm8GPXEgpK42gY4eqKL6RzVzogjVfrG+GZPPMOleYUgn1DsAkln1KmB:+JFQXL6LUZPPMOleYUgn1DEam
TLSH
T1B2C5AF4A67B500E8C177D178CA5B961BE77174480330ABEB13E48A652FE3BE05B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
layuh.exe

File Explorer

layuh.exe

.exe 2.5MB

layuh.exe

IMPHASH f4031c52a9439e355574484e0a8bce37
SHA256 ff478544cdfdfc21247c5f4b8b55c555120d91d1235bf3771617ee79276740a6
MD5 c90589cdece602f2082779b1d545dd6c
SHA1 2be0987aba1bd7625ba46bf6cac2127a02e0720f
SHA512 14845fcc6bc4be0b3b94145f3605c663e551915237f5fb4829b28b0a6b5fe466344026792b798b4facf5456848cbe32d2f2c32689951de4911f060d9b1939944
SSDEEP 49152:+BaFLm8GPXEgpK42gY4eqKL6RzVzogjVfrG+GZPPMOleYUgn1DsAkln1KmB:+JFQXL6LUZPPMOleYUgn1DEam
TLSH
T1B2C5AF4A67B500E8C177D178CA5B961BE77174480330ABEB13E48A652FE3BE05B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1952868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpSetTimeouts

kernel32

ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW CreateFileA GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW ExitProcess lstrcpynW GetLastError DuplicateHandle Module32First GetProcessId Module32Next GetCurrentProcess VirtualQueryEx VirtualProtectEx GetTickCount64 WriteProcessMemory Process32FirstW Process32NextW K32GetModuleFileNameExA OpenProcess ReadProcessMemory GetCurrentThread SetThreadPriority GetConsoleWindow GetCurrentProcessId GetConsoleMode SetCurrentConsoleFontEx SetConsoleMode GetStdHandle SetConsoleTextAttribute GetTickCount CloseHandle Process32Next Sleep CreateToolhelp32Snapshot Process32First GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA SetLastError CreateFileW HeapDestroy HeapSize InitializeCriticalSectionEx DeleteCriticalSection GetFileSizeEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleW FindNextFileW

user32

ShowWindow UpdateWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW OpenClipboard GetAsyncKeyState GetWindowRect CloseClipboard DispatchMessageA DefWindowProcW SendMessageA EnumWindows EmptyClipboard DestroyWindow SetWindowLongA SetWindowTextA GetClipboardData GetWindowLongA GetWindowTextA GetClassNameA GetWindowThreadProcessId SetClipboardData FindWindowA SendInput GetMessageExtraInfo LoadCursorA GetMonitorInfoA MonitorFromWindow MapVirtualKeyA ScreenToClient GetCapture keybd_event IsWindow ShowCursor GetDesktopWindow LoadImageW ClientToScreen SetForegroundWindow AppendMenuW DestroyMenu DefWindowProcA TrackMouseEvent GetKeyboardLayout TrackPopupMenu CreatePopupMenu SendMessageW PostMessageA MessageBoxA GetMessageA SetWindowDisplayAffinity GetKeyState PostQuitMessage MoveWindow SetLayeredWindowAttributes TranslateMessage GetForegroundWindow SetCapture SetCursor PeekMessageA GetCursorPos GetClientRect SetProcessDPIAware ReleaseDC GetDC LoadIconA IsWindowUnicode SetCursorPos ReleaseCapture

gdi32

GetDeviceCaps CreateSolidBrush

advapi32

SystemFunction036 GetLengthSid RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetTokenInformation IsValidSid RegCreateKeyExA RegDeleteKeyA CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteA Shell_NotifyIconW

d3dcompiler_43

D3DCompile

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Thrd_id _Thrd_join _Cnd_broadcast ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks ?id@?$ctype@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?__ExceptionPtrToBool@@YA_NPEBX@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

winmm

timeBeginPeriod

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertEnumCertificatesInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError getsockopt gethostname inet_pton sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs ioctlsocket

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __std_exception_destroy strchr _purecall __std_terminate longjmp memcpy memmove memset memchr strrchr __C_specific_handler __intrinsic_setjmp __current_exception_context __current_exception memcmp wcschr _CxxThrowException __std_exception_copy

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode calloc realloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_errno terminate _invoke_watson _invalid_parameter_noinfo system __sys_errlist __sys_nerr _resetstkoflw _beginthreadex exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _configure_narrow_argv _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment abort

api-ms-win-crt-math-l1-1-0

logf sqrtf _fdopen _dsign acosf asinf pow __setusermatherr log atan2f _dclass powf ceilf roundf cosf sinf floorf fmodf _fdclass sqrt ldexp

api-ms-win-crt-string-l1-1-0

strlen wcslen wcscpy_s _wcsdup strcspn wcspbrk strspn wcsncmp strncpy tolower strpbrk wcsncpy strncmp _strdup strcpy_s _stricmp strcmp

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoul atoi wcstombs atof strtoll strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _lseeki64 ftell __stdio_common_vsprintf_s fseek _wopen _wfopen fputc __p__commode _read __stdio_common_vfprintf _write fflush fwrite _fileno _close fgetc fputs __acrt_iob_func _popen _pclose fgets fclose fread feof _set_fmode fgetpos _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 strftime _time64

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _fstat64 _wstat64 _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv