Petya[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Petya.exe
Size 788KB
Sample260823-cpppmaha92
SHA256 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c
MD5 a92f13f3a1b3b39833d3cc336301b713
SHA1 d1c62ac62e68875085b62fa651fb17d4d7313887
SHA512 361a5199b5a6321d88f6e7b66eaad3756b4ea7a706fa9dbbe3ffe29217f673d12dd1200e05f96c2175feffc6fecc7f09fda4dd6bfa0ce7bef3d9372f6a534920
SSDEEP 24576:z0wz1d5bAbWhrc56zQ9T4Ole+5PIuklOjB:Hd5Vhr4IMTbeGPJHjB
TLSH
T152058D22B2D0C07AC8375371982ADB2924B7B9754835010F77E9662E6EB33D35E35E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Petya.exe

File Explorer

Petya.exe

.exe 788KB

Petya.exe

IMPHASH bf084102e13441ce39f8d51d9bf55857
SHA256 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c
MD5 a92f13f3a1b3b39833d3cc336301b713
SHA1 d1c62ac62e68875085b62fa651fb17d4d7313887
SHA512 361a5199b5a6321d88f6e7b66eaad3756b4ea7a706fa9dbbe3ffe29217f673d12dd1200e05f96c2175feffc6fecc7f09fda4dd6bfa0ce7bef3d9372f6a534920
SSDEEP 24576:z0wz1d5bAbWhrc56zQ9T4Ole+5PIuklOjB:Hd5Vhr4IMTbeGPJHjB
TLSH
T152058D22B2D0C07AC8375371982ADB2924B7B9754835010F77E9662E6EB33D35E35E4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

316285

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

IIDFromString StringFromGUID2 OleUninitialize OleInitialize OleRun OleSetContainedObject CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance

shell32

SHGetFolderPathW FindExecutableA Shell_NotifyIconA SHGetFolderPathA ShellExecuteExA

wininet

InternetTimeFromSystemTime InternetTimeToSystemTime InternetCrackUrlA HttpQueryInfoA InternetConnectA InternetReadFile HttpOpenRequestA InternetGetConnectedState InternetErrorDlg HttpSendRequestA InternetOpenA InternetCloseHandle

user32

IsChild SetFocus SetRect GetWindowThreadProcessId RegisterClassExA GetFocus GetAncestor GetSystemMenu GetWindowRect GetParent GetClientRect SendMessageA GetClassInfoExW GetDC TranslateMessage RegisterClassExW GetWindowLongW ReleaseDC EnableMenuItem SetWindowLongW GetDesktopWindow SetWindowPos CreateWindowExW AdjustWindowRectEx LoadCursorA SetWindowLongA GetWindowLongA CreateWindowExA MessageBoxA CharNextA DispatchMessageW RegisterClassA LoadImageA GetSystemMetrics DispatchMessageA PostMessageA AppendMenuA CreatePopupMenu ShowWindow MsgWaitForMultipleObjectsEx GetCursorPos DefWindowProcA IsWindowUnicode SetWindowTextW DefWindowProcW wsprintfA LoadStringA DestroyWindow GetMessageA GetMessageW PostQuitMessage TrackPopupMenu SetForegroundWindow PeekMessageA

comctl32

InitCommonControlsEx

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueW VerQueryValueA

kernel32

GetStdHandle WriteConsoleW GetConsoleMode GetConsoleCP GetFileType GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc GetModuleFileNameW HeapAlloc HeapFree FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW SetStdHandle HeapReAlloc GetCPInfo RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter ExitThread CreateDirectoryW VirtualProtect GetFullPathNameW HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapSize GetLocaleInfoW SetHandleCount GetTimeZoneInformation SetFilePointer FlushFileBuffers IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW lstrcmpA GetModuleHandleA FindResourceA lstrlenA GetModuleHandleExA FreeLibrary LoadResource SetEndOfFile InterlockedDecrement GetCommandLineA WideCharToMultiByte InitializeCriticalSectionAndSpinCount SizeofResource SetDllDirectoryA IsDBCSLeadByte MultiByteToWideChar lstrlenW RaiseException GetLastError lstrcmpiA GetProcAddress GetModuleFileNameA LoadLibraryExA CreateMutexA DeleteCriticalSection CloseHandle WaitForSingleObject FormatMessageA GetExitCodeProcess LocalFree DeleteFileA SetEvent CreateEventA lstrcatA ResetEvent WaitForMultipleObjects CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile Sleep ReadFile OpenEventA GetSystemTime GetCurrentProcess GetTickCount GetCurrentProcessId GetTempPathA SystemTimeToFileTime FileTimeToSystemTime MulDiv InterlockedExchange InterlockedExchangeAdd LocalAlloc GetCurrentThreadId FormatMessageW GetLocalTime ExitProcess GetLocaleInfoA GetWindowsDirectoryA OpenProcess TerminateProcess GetSystemDirectoryA FindFirstFileA FindClose LoadLibraryA LockResource GetNativeSystemInfo PeekNamedPipe SetHandleInformation CreateProcessA CreateDirectoryA GetProcessHeap CreatePipe GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage MoveFileExA GetFileAttributesA FindNextFileA OpenThread GetExitCodeThread GetModuleHandleExW LoadLibraryW LoadLibraryExW ReleaseMutex QueryPerformanceCounter QueryPerformanceFrequency CreateFileW SetFilePointerEx InitializeCriticalSection LeaveCriticalSection EnterCriticalSection InterlockedCompareExchange GetStringTypeW EncodePointer DecodePointer GetCurrentDirectoryW GetFileInformationByHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA InterlockedIncrement RemoveDirectoryA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyW RegSetValueExA CryptGetHashParam RegQueryInfoKeyA GetTokenInformation CopySid GetWindowsAccountDomainSid CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW RegQueryValueExA CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptHashData RegEnumKeyA OpenProcessToken

oleaut32

SysFreeString VarUI4FromStr VariantClear SysAllocString VariantCopy VariantInit VariantChangeType GetErrorInfo SysStringByteLen

shlwapi

ord12

gdi32

GetStockObject GetDeviceCaps

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptStringToBinaryA CryptBinaryToStringA CryptProtectData CryptUnprotectData

msi

ord141 ord168 ord160 ord158 ord115 ord159 ord117 ord8 ord44 ord204 ord189 ord67 ord31 ord137 ord91