WinShell[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WinShell.exe
Size 32KB
Sample260825-snbpda1vbx
SHA256 f4a18555a77746bcd5453c3f0aea3f46b5cfb7f035087fe884496b1d94c667af
MD5 c1a649083ac064746818b6f7ca4c5e4d
SHA1 a33bcc95b4bcba381ee1ba170630c68efb3a2121
SHA512 b48cd7f9eee81c8073dff028d2415ca2bc4b641dd55733d13ce3ddbc1fbf220f9a46c10dbc90e6b6117acf9d5eca5c6a72486f03fe6b8bfdf11b43fdedcc3292
SSDEEP 384:mgMKR7o3011D/91Icsp9rbkeVSfNbU+vPTLYWjAeuibChNo8k4F2oZGuvrzQC84H:m/KFnsFV23l4a8k8Przr84VtnWeWQ/G
TLSH
T10EE23B237A9B8032C15253B1582ADBE543BFBEB10B71A2C7B7C45A5E0A341D1ADF6707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinShell.exe

File Explorer

WinShell.exe

.exe 32KB

WinShell.exe

IMPHASH c3de72b578095299a9ce38ba0f0cf479
SHA256 f4a18555a77746bcd5453c3f0aea3f46b5cfb7f035087fe884496b1d94c667af
MD5 c1a649083ac064746818b6f7ca4c5e4d
SHA1 a33bcc95b4bcba381ee1ba170630c68efb3a2121
SHA512 b48cd7f9eee81c8073dff028d2415ca2bc4b641dd55733d13ce3ddbc1fbf220f9a46c10dbc90e6b6117acf9d5eca5c6a72486f03fe6b8bfdf11b43fdedcc3292
SSDEEP 384:mgMKR7o3011D/91Icsp9rbkeVSfNbU+vPTLYWjAeuibChNo8k4F2oZGuvrzQC84H:m/KFnsFV23l4a8k8Przr84VtnWeWQ/G
TLSH
T10EE23B237A9B8032C15253B1582ADBE543BFBEB10B71A2C7B7C45A5E0A341D1ADF6707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\romyc\Desktop\VSProjects\WinShell\Release\WinShell.pdb

kernel32

CreateProcessW CloseHandle GetLastError GetLocaleInfoEx FormatMessageA LocalFree FindClose FindFirstFileW GetFileAttributesExW GetModuleHandleW GetFileInformationByHandleEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CreateFileW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

msvcp140

?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ??7ios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JG@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

vcruntime140

memmove __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate memcpy memset _except_handler4_common _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

__p___argc _invoke_watson _exit exit _initterm_e _controlfp_s _get_initial_narrow_environment __p___argv _c_exit _seh_filter_exe _cexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _crt_atexit _register_thread_local_exe_atexit_callback _initterm abort _set_app_type

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode