GetHWID[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GetHWID.exe
Size 23KB
Sample260903-wlwtbasfqe
SHA256 41b62c3ab41bc4c3dd1ace41fef8c1b5c0fe814c5f14b2b415e033225348a0c4
MD5 6387a4c8db9411a3d9ee65e5d1357358
SHA1 b68b6d3b8fcd4baf281db3d5819e528201da3069
SHA512 11f0c60ffde9e4c39c34c27ad859bdb3f869890a547e6e4f4f9b015a2bfd67ddd4d1dc19cc889844a10920795a9bc1a683f271be0f98fa9a5399667c1be3c874
SSDEEP 384:hCMj0X4J0satyZlKP9IQI7rclG+1Yizr7OQIHlOWljfKF7yCU0GGRY/43XWO:BW9OlmNI7rclG+1YcnOlHFbK9yCpGLQ3
TLSH
T1DCB23A1BFB6A08E8E4A7D53D88B30D15D372B905E711D6CF2761048A0F772E1AE3E842
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GetHWID.exe

File Explorer

GetHWID.exe

.exe 23KB

GetHWID.exe

IMPHASH 6c0862521159007722a13236d2572ad8
SHA256 41b62c3ab41bc4c3dd1ace41fef8c1b5c0fe814c5f14b2b415e033225348a0c4
MD5 6387a4c8db9411a3d9ee65e5d1357358
SHA1 b68b6d3b8fcd4baf281db3d5819e528201da3069
SHA512 11f0c60ffde9e4c39c34c27ad859bdb3f869890a547e6e4f4f9b015a2bfd67ddd4d1dc19cc889844a10920795a9bc1a683f271be0f98fa9a5399667c1be3c874
SSDEEP 384:hCMj0X4J0satyZlKP9IQI7rclG+1Yizr7OQIHlOWljfKF7yCU0GGRY/43XWO:BW9OlmNI7rclG+1YcnOlHFbK9yCpGLQ3
TLSH
T1DCB23A1BFB6A08E8E4A7D53D88B30D15D372B905E711D6CF2761048A0F772E1AE3E842
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\monster\Documents\бупес\D3D11 Overlay ImGui\x64\Release\GetHWID.pdb

kernel32

GetVolumeInformationA GlobalAlloc GlobalFree GlobalLock SetConsoleCP SetConsoleOutputCP GetStdHandle RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess SetConsoleTitleA SetConsoleTextAttribute GlobalUnlock GetSystemFirmwareTable IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

user32

EmptyClipboard CloseClipboard OpenClipboard SetClipboardData

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

msvcp140

?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memmove __std_exception_destroy memcpy __C_specific_handler _CxxThrowException __current_exception __std_exception_copy __current_exception_context memset

api-ms-win-crt-string-l1-1-0

toupper

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit _invoke_watson _initialize_onexit_table __p___argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale