Trojan[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.exe
Size 102KB
Sample260820-aaawtabr2t
SHA256 cec1eb2f9c76d58d2bb4a13bcc65dd5eb08bf449f39c6dadcf4f8ce77d138f0e
MD5 a4d474f6b3c4d79c63b92f240b0fa70c
SHA1 6a110c50bf44e6823819a0ea27bfe283b683ccfe
SHA512 14328dba26fade5af4c66dc7cd421d001b3df18add24b45d18c34b76d1889eda52c293aead115f574cb4ab52791857dbe92647e1b8c8dba7e8b875516705965d
SSDEEP 3072:8da2zx9nSpKA8da3nJI9d5KQAy0dHqb7pq+:8dZbSpKndMJAd5pVq+
TLSH
T180A34C199AEA106AE366C974CA728755ED31BC8147B3B2DF57408ED50D12BD0FF39E02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Trojan.exe

File Explorer

Trojan.exe

.exe 102KB

Trojan.exe

IMPHASH c7b704dc0782b3975aa38d640f6c5fb2
SHA256 cec1eb2f9c76d58d2bb4a13bcc65dd5eb08bf449f39c6dadcf4f8ce77d138f0e
MD5 a4d474f6b3c4d79c63b92f240b0fa70c
SHA1 6a110c50bf44e6823819a0ea27bfe283b683ccfe
SHA512 14328dba26fade5af4c66dc7cd421d001b3df18add24b45d18c34b76d1889eda52c293aead115f574cb4ab52791857dbe92647e1b8c8dba7e8b875516705965d
SSDEEP 3072:8da2zx9nSpKA8da3nJI9d5KQAy0dHqb7pq+:8dZbSpKndMJAd5pVq+
TLSH
T180A34C199AEA106AE366C974CA728755ED31BC8147B3B2DF57408ED50D12BD0FF39E02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MathisS\Desktop\malware\Injecteur\x64\Release\Trojan.pdb

kernel32

GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead QueryFullProcessImageNameW GetCurrentProcessId CreateFileA Sleep OpenProcess CreateFileW DeviceIoControl CloseHandle Process32FirstW Process32NextW GetLastError CreateToolhelp32Snapshot GetModuleHandleW QueryPerformanceCounter SetUnhandledExceptionFilter

user32

MessageBoxA

advapi32

OpenServiceA CreateServiceW OpenSCManagerW StartServiceW OpenServiceW CreateServiceA RegCloseKey CloseServiceHandle OpenSCManagerA DeleteService ControlService StartServiceA RegSetValueExA RegOpenKeyExA

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xbad_alloc@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Id_cnt@id@locale@std@@0HA ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset __current_exception __current_exception_context memcpy _CxxThrowException __std_exception_copy __std_exception_destroy __std_terminate __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _fseeki64 __p__commode fputc fflush __stdio_common_vswprintf _set_fmode fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcslen

api-ms-win-crt-runtime-l1-1-0

exit system terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm _initterm_e _exit _c_exit __p___argc __p___argv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale