something[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
something.exe
Size 3.4MB
Sample260831-jpp4qazvbx
SHA256 f2656922127658f31165d50108c85d945f436008048d897c99dcba8b193aa0b8
MD5 76014e141076dabdd9e6c71e7744c01b
SHA1 b5fdef19a53de04f81eb960a9de3b9cb68639fe9
SHA512 bf5dfad5134fe5e185e4e611afcdf5b5b157bd0b5a8efe2aa4ebd31166d8261878dbae6ea1573da01c28bb54363ac8a2b9fb061c0be38916090237605769979a
SSDEEP 49152:LARLx6etvvY/G9JrnBIfVcQutcoBaAt5+:s4/4/Qu9B
TLSH
T197F5BF63F75111F9D9769038CAA2932BF336B454072183DB63989A296F43BF01F76B84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
something.exe

File Explorer

something.exe

.exe 3.4MB

something.exe

IMPHASH 03282836ff7cbf9be7bcfb3dfb352fc1
SHA256 f2656922127658f31165d50108c85d945f436008048d897c99dcba8b193aa0b8
MD5 76014e141076dabdd9e6c71e7744c01b
SHA1 b5fdef19a53de04f81eb960a9de3b9cb68639fe9
SHA512 bf5dfad5134fe5e185e4e611afcdf5b5b157bd0b5a8efe2aa4ebd31166d8261878dbae6ea1573da01c28bb54363ac8a2b9fb061c0be38916090237605769979a
SSDEEP 49152:LARLx6etvvY/G9JrnBIfVcQutcoBaAt5+:s4/4/Qu9B
TLSH
T197F5BF63F75111F9D9769038CAA2932BF336B454072183DB63989A296F43BF01F76B84
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1461216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\larry\Downloads\external base roblox\x64\Release\something.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA Process32First GetCurrentProcess Module32Next GetProcessId Module32First DuplicateHandle OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle VirtualProtectEx VirtualQueryEx VirtualAllocEx ReleaseMutex ExitProcess SetConsoleTitleA CreateMutexA GetLastError GetSystemInfo AllocConsole CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA InitOnceExecuteOnce FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW LoadLibraryA HeapQueryInformation HeapSize GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock SetStdHandle CreateFileW WriteConsoleW ExitThread CreateThread GlobalFree GlobalAlloc MultiByteToWideChar FindClose SetEnvironmentVariableW FindNextFileW SetEndOfFile RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread ReleaseSRWLockShared AcquireSRWLockShared LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo

user32

GetClientRect SetCursor SetCapture GetForegroundWindow GetDpiForWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetKeyboardLayout DefWindowProcW DispatchMessageA DestroyWindow GetSystemMetrics ShowWindow SetWindowDisplayAffinity MoveWindow CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage FindWindowA RegisterClassExA UpdateWindow SetWindowLongA GetAsyncKeyState TrackMouseEvent SendInput GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen IsWindowUnicode

gdi32

CreateSolidBrush

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

ole32

PropVariantClear CoCreateInstance

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

wininet

InternetOpenA InternetCloseHandle InternetSetCookieExA HttpQueryInfoA InternetOpenUrlA InternetReadFile

vcomp140

_vcomp_flush _vcomp_for_static_end _vcomp_for_static_simple_init _vcomp_fork _vcomp_atomic_add_i8

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

911KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

782KB

Virtual Size

789KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

something.exe

d3d11

dwmapi

kernel32

user32

gdi32

advapi32

ole32

imm32

d3dcompiler_47

wininet

vcomp140

generic