420[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
420.exe
Size 7.2MB
Sample260827-xd97eaywhy
SHA256 69ad97c5624150ea9c4387f3b3941627be5b2a7ee5a6a4499133eaff009df9b6
MD5 1413ab70a0cf89eadaaca08d6aad1b85
SHA1 4bfd6b2051de8858224eead56930104f97dcdf82
SHA512 2797264909691c99fc7376e27be78bb0ddea7f2ec939c70bb96080d41a5c3a4513cb55dd3e1004fc205a22bc4cf5f103d7be2478afa583ecfeddbb1c1f333ca5
SSDEEP 196608:4JQ01XJKNop57ZBisLQLPH/M8xAwlCfa5TxymQIDt:J0FJKk1BisLQLPH/MallCfRm3R
TLSH
T15F76C0C7A3D8AD9BC03654798901E1039EE2F800832593FBFBE6AD1DC6166E40E7DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
420.exe

File Explorer

420.exe

.exe 7.2MB

420.exe

IMPHASH 767329bd8053beee6835d2463452ae2f
SHA256 69ad97c5624150ea9c4387f3b3941627be5b2a7ee5a6a4499133eaff009df9b6
MD5 1413ab70a0cf89eadaaca08d6aad1b85
SHA1 4bfd6b2051de8858224eead56930104f97dcdf82
SHA512 2797264909691c99fc7376e27be78bb0ddea7f2ec939c70bb96080d41a5c3a4513cb55dd3e1004fc205a22bc4cf5f103d7be2478afa583ecfeddbb1c1f333ca5
SSDEEP 196608:4JQ01XJKNop57ZBisLQLPH/M8xAwlCfa5TxymQIDt:J0FJKk1BisLQLPH/MallCfRm3R
TLSH
T15F76C0C7A3D8AD9BC03654798901E1039EE2F800832593FBFBE6AD1DC6166E40E7DB55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

864668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

advapi32

CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey RegQueryValueExW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegFlushKey RegQueryInfoKeyW RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegSetKeyValueW CryptReleaseContext CryptImportKey CryptEncrypt

gdi32

CreateRoundRectRgn

dwmapi

DwmExtendFrameIntoClientArea

user32

TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetWindowRgn GetForegroundWindow UpdateWindow PostQuitMessage GetCursorPos PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow MessageBoxA ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW DispatchMessageA SetCapture GetWindowRect DestroyWindow GetClientRect SetCursorPos ReleaseCapture IsWindowUnicode SetCursor

kernel32

HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode WriteFile GetModuleFileNameW SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW DeleteFileW FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree GetModuleHandleA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLastError VirtualFree DeviceIoControl VirtualAlloc CreateFileW GetCurrentThreadId CloseHandle GetCurrentProcessId GetTempPathW FatalAppExitA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryW GetModuleHandleW LoadLibraryW GetEnvironmentVariableA SetLastError FormatMessageW Sleep MoveFileExW GetStdHandle GetFileType ReadFile PeekNamedPipe FlushFileBuffers GetTickCount WaitForSingleObjectEx VerifyVersionInfoW GetFileSizeEx WakeConditionVariable HeapFree SleepConditionVariableSRW RtlPcToFileHeader RaiseException FormatMessageA TryAcquireSRWLockExclusive SwitchToThread GetTimeFormatW GetNativeSystemInfo LocalFree GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx GetSystemTimeAsFileTime WriteConsoleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead TlsSetValue FlsAlloc FlsGetValue FlsSetValue FlsFree WakeAllConditionVariable TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RtlUnwindEx GetUserDefaultLCID HeapReAlloc SetStdHandle SetEndOfFile GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW CompareStringW LCMapStringW IsValidLocale GetLocaleInfoW GetExitCodeThread EnumSystemLocalesW GetProcessHeap HeapSize WaitForMultipleObjects

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

shell32

SHGetFolderPathA

ntdll

RtlInitUnicodeString NtQuerySystemInformation NtQueryVirtualMemory

bcrypt

BCryptGenRandom

ws2_32

WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAEventSelect htons WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt gethostname ioctlsocket htonl select __WSAFDIsSet freeaddrinfo getaddrinfo listen accept sendto recvfrom WSACleanup WSAStartup inet_ntop inet_pton WSAIoctl WSASetLastError socket setsockopt ntohs send

crypt32

CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertFindExtension CertOpenStore CertCloseStore

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

seryx

Size

987KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

420.exe

d3d11

d3dx11_43

d3dcompiler_43

advapi32

gdi32

dwmapi

user32

kernel32

imm32

shell32

ntdll

bcrypt

ws2_32

crypt32

generic