gs-TC1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gs-TC1.exe
Size 2.7MB
Sample260820-2tdklabq31
SHA256 3eef25bf916234a84f23413f76bd99c534c13166806289f2373e98115ab51bcd
MD5 4f4e757c6fe5b123db49c196b3f0f55f
SHA1 411c38fa9671810a75bed4872a1ca1a5da3d3fb1
SHA512 d09aa2e5c77bf64d734b2261ef6c48ae8cb470842896fdf31f5efcef336cd692a71215d533da9f7a5073e35e5809bbd989247257f35b8aba058b6caa2bc214f5
SSDEEP 49152:gEyO5iWMB4OdDP2P9bTu+S76VnQ7FMW6lHgt:3y+i+9bTcu
TLSH
T11AD5C6B2F35100EEC817ACBE451F4FAB5AF235A30F2C59C7B1E4E5A0A5721908765DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gs-TC1.exe

File Explorer

gs-TC1.exe

.exe 2.7MB

gs-TC1.exe

IMPHASH a3d8e52b44fdfd5fb6f608ae4f4af41c
SHA256 3eef25bf916234a84f23413f76bd99c534c13166806289f2373e98115ab51bcd
MD5 4f4e757c6fe5b123db49c196b3f0f55f
SHA1 411c38fa9671810a75bed4872a1ca1a5da3d3fb1
SHA512 d09aa2e5c77bf64d734b2261ef6c48ae8cb470842896fdf31f5efcef336cd692a71215d533da9f7a5073e35e5809bbd989247257f35b8aba058b6caa2bc214f5
SSDEEP 49152:gEyO5iWMB4OdDP2P9bTu+S76VnQ7FMW6lHgt:3y+i+9bTcu
TLSH
T11AD5C6B2F35100EEC817ACBE451F4FAB5AF235A30F2C59C7B1E4E5A0A5721908765DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1158736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoInitializeEx CoUninitialize

msvcp140

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??7ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

gdi32

GetDeviceCaps

dwmapi

DwmExtendFrameIntoClientArea

user32

GetWindowThreadProcessId SetWindowLongA MessageBoxA GetWindowRect SetForegroundWindow UpdateWindow GetSystemMetrics BringWindowToTop IsIconic SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA AttachThreadInput PeekMessageA DispatchMessageA TranslateMessage MapVirtualKeyA FindWindowExA PostMessageA IsWindow FindWindowA SendInput GetAsyncKeyState EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout MonitorFromPoint

kernel32

GetModuleHandleW GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree GetFileInformationByHandleEx HeapAlloc GetFileSizeEx CreateFileA GetConsoleWindow GetModuleFileNameA CreateProcessA Module32Next Module32First Process32First CreateToolhelp32Snapshot OpenProcess GetProcessId CloseHandle WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetLocalTime GetCurrentThreadId ExitProcess GetFileAttributesA GetEnvironmentVariableA SetThreadPriority GetCurrentThread GetTickCount64 Sleep SetConsoleMode GetConsoleMode GetStdHandle WideCharToMultiByte GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetLocaleInfoA MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime WakeAllConditionVariable ReadFile Process32Next InitializeSListHead

shell32

ShellExecuteW

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

winmm

timeBeginPeriod

vcruntime140

strstr __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler longjmp strrchr memcmp strchr memchr __std_terminate memmove __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen strncpy_s strcpy_s isdigit wcslen _stricmp tolower strncmp strncpy strcmp isupper

api-ms-win-crt-math-l1-1-0

fmodf __setusermatherr nearbyint expf roundf pow logf log atan2f sqrtf ceilf acosf cosf floorf powf sinf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

__p__commode ungetc setvbuf __stdio_common_vsprintf_s _fseeki64 fsetpos fgetpos fgetc _get_stream_buffer_pointers __stdio_common_vsscanf __stdio_common_vsprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func __stdio_common_vfprintf fputc _set_fmode

api-ms-win-crt-convert-l1-1-0

atof strtol strtoull strtof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

exit _exit _crt_atexit _register_thread_local_exe_atexit_callback _register_onexit_function _c_exit _cexit __p___argv _initterm_e abort _seh_filter_exe __p___argc _set_app_type _configure_narrow_argv _errno terminate _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _beginthreadex _initterm

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale