trump perm patched(1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
trump perm patched(1).exe
Size 2.3MB
Sample260825-11xflseq6y
SHA256 73b89f28762897579a7dfdfe1d4e4a57bc81db3cbc3d1a3506cc1d5201139860
MD5 e098b6fa30cb0411a7b14b5b5702f208
SHA1 337d66d4b06a4b7a6853a5a0b29bc212969f9782
SHA512 5ca69f3a50f0496d4cb1d605292550505c2e50d18c377dc13a4206f9976ccdb480776d666cc35a1421023d9b173e9cd7bf9819969c550a7e5e3a67dc6f75799c
SSDEEP 49152:1VIW6IVx6niLH0v4UIm/aSJi1byw+NXqBVeP:NFI/aKwK8e
TLSH
T150B5BF03B7ED8268D17369388AB7C362B333BC415B21924B77A40564AE931E45F7B7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
trump perm patched(1).exe

File Explorer

trump perm patched(1).exe

.exe 2.3MB

trump perm patched(1).exe

IMPHASH 71bbe6d1a3412e3970ee20ecbe1a9ced
SHA256 73b89f28762897579a7dfdfe1d4e4a57bc81db3cbc3d1a3506cc1d5201139860
MD5 e098b6fa30cb0411a7b14b5b5702f208
SHA1 337d66d4b06a4b7a6853a5a0b29bc212969f9782
SHA512 5ca69f3a50f0496d4cb1d605292550505c2e50d18c377dc13a4206f9976ccdb480776d666cc35a1421023d9b173e9cd7bf9819969c550a7e5e3a67dc6f75799c
SSDEEP 49152:1VIW6IVx6niLH0v4UIm/aSJi1byw+NXqBVeP:NFI/aKwK8e
TLSH
T150B5BF03B7ED8268D17369388AB7C362B333BC415B21924B77A40564AE931E45F7B7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

441888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

FreeLibrary QueryPerformanceCounter SetConsoleTitleA GetCurrentProcess TerminateProcess K32GetModuleFileNameExW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle LoadLibraryW GetCurrentProcessId GetConsoleWindow CreateProcessA K32EnumProcessModules GetTickCount IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent WideCharToMultiByte GetModuleHandleW GetLastError QueryPerformanceFrequency GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetProcAddress LoadLibraryA GlobalLock GlobalUnlock GlobalFree GlobalAlloc MultiByteToWideChar GetFileInformationByHandleEx ReleaseSRWLockExclusive AreFileApisANSI AcquireSRWLockExclusive

user32

SetWindowLongA GetWindowLongW GetWindowThreadProcessId DefWindowProcW FindWindowExW SetClipboardData GetClipboardData EmptyClipboard PeekMessageW GetWindowRect MoveWindow SetLayeredWindowAttributes TranslateMessage ShowWindow RegisterClassExW LoadIconW UnregisterClassW PostQuitMessage UpdateWindow DestroyWindow CreateWindowExW GetWindowTextW GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect GetSystemMetrics IsWindowUnicode ReleaseCapture DispatchMessageW SetCursorPos CloseClipboard OpenClipboard GetCursorPos

advapi32

GetUserNameA RegOpenKeyExA GetUserNameW RegCloseKey RegQueryValueExA

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntryA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memchr memcmp wcsrchr strstr __std_terminate __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _pclose fgetpos fsetpos feof ungetc fputc _fseeki64 _popen fgets __p__commode _set_fmode __stdio_common_vsscanf fread setvbuf __stdio_common_vsprintf _wfopen fwrite ftell __stdio_common_vfprintf fseek fclose fflush fgetc __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _wassert __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _errno exit _beginthreadex terminate abort system _invoke_watson _register_onexit_function

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncmp towlower _wcsicmp toupper isspace isalnum strncpy strcmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-time-l1-1-0

_localtime64_s _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

cosf ceilf acosf powf fmodf sinf sqrtf __setusermatherr