SP[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SP.exe
Size 28KB
Sample260826-dfphya1hmd
SHA256 11fdf24893792bfd581a5eb65709ca7915b38447e318ef22b3a60e4ecd51fe37
MD5 73c462daba83a56026306a963a827c30
SHA1 d9317093f6300105bc289eba80793299e4a1ae01
SHA512 b237be4378c68bbc26075251ce264b9ac9ac177993fd31b0489cdd37e9dda1e0436fd51ac7e641c8f39b6d181770f4192446253fc9696cd6b855969b9e084294
SSDEEP 768:8R3tSN8Ek+8Rmhrk6PUKTK8XYGVy/49JxaYIRsEm0jVW9GjsGh:8R3tSN8v+8yDTKEy/49JwRsEm0jVW9G7
TLSH
T11DD22B6F671A48E8C173D17CC0E3221AD3B17C526BE2D6DF83C0D96A5F252D09A35E86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SP.exe

File Explorer

SP.exe

.exe 28KB

SP.exe

IMPHASH 45869432080c5cf2ab557c0fcc50b72e
SHA256 11fdf24893792bfd581a5eb65709ca7915b38447e318ef22b3a60e4ecd51fe37
MD5 73c462daba83a56026306a963a827c30
SHA1 d9317093f6300105bc289eba80793299e4a1ae01
SHA512 b237be4378c68bbc26075251ce264b9ac9ac177993fd31b0489cdd37e9dda1e0436fd51ac7e641c8f39b6d181770f4192446253fc9696cd6b855969b9e084294
SSDEEP 768:8R3tSN8Ek+8Rmhrk6PUKTK8XYGVy/49JxaYIRsEm0jVW9GjsGh:8R3tSN8v+8yDTKEy/49JwRsEm0jVW9G7
TLSH
T11DD22B6F671A48E8C173D17CC0E3221AD3B17C526BE2D6DF83C0D96A5F252D09A35E86
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mnjmk\Desktop\permspoofer\x64\Release\SP.pdb

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetStdHandle GetConsoleCursorInfo Sleep SetConsoleCursorInfo Beep SetConsoleCP SetConsoleOutputCP RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

msvcp140

?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memcpy __C_specific_handler __current_exception_context __current_exception __std_terminate __std_exception_copy __std_exception_destroy memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _exit exit _cexit _c_exit system _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe terminate __p___argv _invalid_parameter_noinfo_noreturn _initterm_e

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale