patched[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
patched.exe
Size 5.3MB
Sample260905-vky2lsfl51
SHA256 1a8a0e2281818e9600856b2cff4d7125efb15932690ff4fd816246719919bf28
MD5 1af322861913cdad69308ec674a6f589
SHA1 b2e80ced322ec1eb1deee3c610e477de64d38544
SHA512 18e53a4505598e566c40903d8e5740a40b978b864a029c62b51b20a395fd9c824f6d4452855cc7340e114db67bda6eb43ba9e26e6c0492703f3c33a6bbd73af5
SSDEEP 98304:GLXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:exYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
TLSH
T1A346F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
patched.exe

File Explorer

patched.exe

.exe 5.3MB

patched.exe

IMPHASH eea1f153e22954527be80a2082704e4d
SHA256 1a8a0e2281818e9600856b2cff4d7125efb15932690ff4fd816246719919bf28
MD5 1af322861913cdad69308ec674a6f589
SHA1 b2e80ced322ec1eb1deee3c610e477de64d38544
SHA512 18e53a4505598e566c40903d8e5740a40b978b864a029c62b51b20a395fd9c824f6d4452855cc7340e114db67bda6eb43ba9e26e6c0492703f3c33a6bbd73af5
SSDEEP 98304:GLXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:exYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
TLSH
T1A346F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1387608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\ALL SOURCES\Impact Services , Vanguard\VMAX2\VMAX\VMAX\VMAX\examples\vmax\Release\vmax.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winmm

PlaySoundA

kernel32

GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx Sleep OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI HeapFree GetCurrentThread SetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler CreateFileW HeapSize LoadLibraryW GetModuleHandleW GetLastError IsDebuggerPresent GetStdHandle FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc lstrcmpA LocalAlloc GetModuleHandleA GetCurrentProcessId GetCurrentProcess CreateFileA K32GetModuleFileNameExW K32EnumProcessModules K32EnumProcesses VirtualProtect GetTempPathW CreateProcessA CloseHandle TerminateProcess LocalFree GetModuleFileNameA DebugBreak WaitForSingleObject GetTickCount64 GetProcAddress OpenProcess LoadLibraryA

user32

ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect CreateWindowExW GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture PostQuitMessage UnregisterClassW SetLayeredWindowAttributes MoveWindow GetSystemMetrics UpdateWindow GetWindowRect SetWindowLongW LoadIconW MessageBoxA TranslateMessage DestroyWindow DispatchMessageW PeekMessageW RegisterClassExW LoadCursorW ScreenToClient GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard DefWindowProcW SendMessageW FindWindowA GetWindowThreadProcessId FindWindowExA GetWindowLongW ShowWindow SetWindowLongA OpenClipboard

advapi32

RegDeleteKeyA RegOpenKeyExA RegQueryValueExA OpenProcessToken GetTokenInformation ConvertSidToStringSidA RegOpenKeyExW RegQueryValueExW AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid RegCreateKeyExA SetSecurityInfo CopySid CryptAcquireContextW CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegCloseKey

shell32

ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear SysStringLen SysFreeString SysAllocString

msvcp140

_Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exceptions@std@@YAHXZ _Thrd_detach ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Thrd_id ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ??7ios_base@std@@QEBA_NXZ _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_join ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z _Query_perf_frequency

shlwapi

StrStrW PathFindFileNameW

ws2_32

ioctlsocket sendto gethostname htons recv recvfrom freeaddrinfo setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getsockname getpeername connect bind inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSACleanup WSAStartup getaddrinfo

crypt32

CertGetCertificateChain CryptDecodeObjectEx CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertAddCertificateContextToStore PFXImportCertStore CertFreeCertificateChain CertFreeCertificateContext CertFindCertificateInStore CertGetNameStringW CertFindExtension CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryW

mpr

WNetGetProviderNameA

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __C_specific_handler wcschr strrchr __std_terminate _purecall strchr memset memcmp _CxxThrowException __std_exception_destroy __std_exception_copy strstr memmove __current_exception_context memchr memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcslen strncmp tolower strcpy_s _strdup strlen _wcsdup strcspn wcspbrk strspn wcsncmp strpbrk wcsncpy toupper strncpy strcmp

api-ms-win-crt-heap-l1-1-0

calloc realloc _callnewh free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_set_app_type _errno exit system __sys_errlist __sys_nerr terminate _register_thread_local_exe_atexit_callback _c_exit abort _invalid_parameter_noinfo __p___argv _resetstkoflw _beginthreadex __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _wassert _seh_filter_exe _cexit _invalid_parameter_noinfo_noreturn _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fgetpos _wfopen _lseeki64 fclose fflush fputc fsetpos _wopen fread _get_stream_buffer_pointers fseek _fseeki64 feof fputs _set_fmode ftell setvbuf fwrite ungetc fgets __stdio_common_vsprintf __p__commode __stdio_common_vsscanf _read _write __acrt_iob_func _fileno _close _popen fgetc __stdio_common_vfprintf _pclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _unlink _wstat64 _fstat64 remove

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-math-l1-1-0

sqrtf acosf __setusermatherr floorf sinf fmodf cosf ceilf fabs _dsign _ldsign _fdsign _dtest _ldtest _fdtest _fdopen powf

api-ms-win-crt-convert-l1-1-0

wcstombs strtod atoi strtol strtoll strtoul strtoull

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv