meo (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
meo (1).exe
Size 3.1MB
Sample260824-xpff6sbp2x
SHA256 4960c663f56fe2feaf09b9c1f5dd9120e274709c67eefc605823d52f4aba32aa
MD5 5ebc9f96f59be899228fe7d48a91ba5c
SHA1 d92cba442e041603a2070b963a03b2fbf9c2e6f3
SHA512 bbfb306c92d49e6ae49ac9f70f5d24fa850aa3b22f1ea259d65bab3dcb5ba48661483015d852c85310173a55f3b3ae32e0b84821b33b7e68dc127b473b5317f9
SSDEEP 49152:XDCxprdehsRycj9j26kY7O6e1F/UnOvmGJFuIU8LjpZUegPz+x5f:GrdrR/j26kGe1F8nk2IUkzG65f
TLSH
T184E5220EAA9B0EB8D9F6D4BC9246643AF57274964370D3DB53C049570F63BE8A23E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meo (1).exe

File Explorer

meo (1).exe

.exe 3.1MB

meo (1).exe

IMPHASH 58c5cc69f17515a6e48ae1be79ebc0d7
SHA256 4960c663f56fe2feaf09b9c1f5dd9120e274709c67eefc605823d52f4aba32aa
MD5 5ebc9f96f59be899228fe7d48a91ba5c
SHA1 d92cba442e041603a2070b963a03b2fbf9c2e6f3
SHA512 bbfb306c92d49e6ae49ac9f70f5d24fa850aa3b22f1ea259d65bab3dcb5ba48661483015d852c85310173a55f3b3ae32e0b84821b33b7e68dc127b473b5317f9
SSDEEP 49152:XDCxprdehsRycj9j26kY7O6e1F/UnOvmGJFuIU8LjpZUegPz+x5f:GrdrR/j26kGe1F8nk2IUkzG65f
TLSH
T184E5220EAA9B0EB8D9F6D4BC9246643AF57274964370D3DB53C049570F63BE8A23E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThread GetCurrentThreadId SetThreadPriority ResumeThread CreateProcessA GetThreadContext SetThreadContext FlushInstructionCache OpenProcess GetTickCount GetSystemDirectoryA VirtualAlloc VirtualProtect VirtualFree VirtualQuery VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualLock VirtualUnlock GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA lstrcpynA lstrlenA QueryFullProcessImageNameA FindResourceA MoveFileExA SetConsoleMode FlushConsoleInputBuffer GetConsoleWindow CreateToolhelp32Snapshot CreateRemoteThread Process32Next Module32First Module32Next K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleInformation CreateThread TerminateProcess ExitProcess GetCurrentProcessId GetCurrentProcess Sleep WaitForSingleObject AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter CloseHandle CheckRemoteDebuggerPresent IsDebuggerPresent GetTempPathA ReadFile DeleteFileA CreateFileA GetCommandLineA InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection RemoveVectoredExceptionHandler GetSystemInfo AddVectoredExceptionHandler LocalFree DeleteCriticalSection Process32First GetStdHandle

user32

MessageBoxA EnableWindow ShowWindow GetWindowTextA FindWindowA EnumWindows GetClassNameA

advapi32

CryptAcquireContextA CryptVerifySignatureW CryptAcquireContextW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptGenRandom FreeSid CheckTokenMembership AllocateAndInitializeSid CryptDestroyKey

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfo

urlmon

URLDownloadToFileA

winhttp

WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpSetOption WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpReadData

msvcp140

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_lock _Mtx_unlock ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Query_perf_frequency _Query_perf_counter ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

vcruntime140

__current_exception_context __std_exception_copy __current_exception __std_terminate memchr memcmp __C_specific_handler memmove memset _CxxThrowException strstr memcpy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _c_exit _set_app_type _seh_filter_exe _cexit __p___argv _configure_narrow_argv terminate _beginthreadex _crt_atexit _invalid_parameter_noinfo_noreturn _register_onexit_function _initialize_onexit_table _initialize_narrow_environment __p___argc

api-ms-win-crt-string-l1-1-0

tolower _stricmp strlen strcpy_s strcmp

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

strtol atoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _get_stream_buffer_pointers fclose fflush fgetc __stdio_common_vsnprintf_s _set_fmode fputc ungetc setvbuf fwrite _fseeki64 fsetpos fread fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale