Sina Free[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Sina Free.exe
Size 14.4MB
Sample260901-y13lhs1thy
SHA256 81643e2e72342c5fb9fcfb26a0e61c944b22b2496d3c2416f63478849d052c2b
MD5 995fc119d723d739d207c647d1975789
SHA1 95ebbd065a0c91fa49238e6fb7eaa0b2dda5e78a
SHA512 454e487a0900c03a396b25395c21c13f835d806f6cd59485ee0c6180be2baeb5e5da2bd147b5e48898f582e4a73dffa09b3f74accd38546bde0d9e1264948431
SSDEEP 393216:NM8+GHwInWsw/h/5IH44Of37HRJy9Hgq2v:NZH1hw/h/yH4427xJy9Hg
TLSH
T19FE623D73EC99678D0C7CF30A28E0B5971D1B7C89AB76A1D37C21C06E530E978A85927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sina Free.exe

File Explorer

Sina Free.exe

.exe 14.4MB

Sina Free.exe

IMPHASH d9029bd9bafaee2e23f6fdae51809ed7
SHA256 81643e2e72342c5fb9fcfb26a0e61c944b22b2496d3c2416f63478849d052c2b
MD5 995fc119d723d739d207c647d1975789
SHA1 95ebbd065a0c91fa49238e6fb7eaa0b2dda5e78a
SHA512 454e487a0900c03a396b25395c21c13f835d806f6cd59485ee0c6180be2baeb5e5da2bd147b5e48898f582e4a73dffa09b3f74accd38546bde0d9e1264948431
SSDEEP 393216:NM8+GHwInWsw/h/5IH44Of37HRJy9Hgq2v:NZH1hw/h/yH4427xJy9Hg
TLSH
T19FE623D73EC99678D0C7CF30A28E0B5971D1B7C89AB76A1D37C21C06E530E978A85927
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11077100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertFreeCertificateChainEngine

ws2_32

freeaddrinfo

advapi32

RegQueryValueExW

d3d12

ord101

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

ole32

CoInitializeEx

kernel32

GetFileInformationByHandleEx

user32

ScreenToClient

gdi32

GetDeviceCaps

shell32

SHCreateDirectoryExW

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

imm32

ImmGetContext

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-runtime-l1-1-0

system

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Name

.text

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

./4T

Size

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.JBS

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.P7g

Size

14.4MB

Virtual Size

14.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Sina Free.exe

crypt32

ws2_32

advapi32

d3d12

dxgi

d3dcompiler_47

dcomp

ole32

kernel32

user32

gdi32

shell32

msvcp140

imm32

shlwapi

psapi

wintrust

dnsapi

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic