hrx[.]exe | Triage™

General

Target
hrx.exe
Size 383KB
Sample260908-t867fseq71
SHA256 b27905e17203e0e343ec2e3d6b5cd34105b42027ad6bfd1242e4c299d41e663c
MD5 863b5af0695b74d7c79ea5433b4773a5
SHA1 02cc42f823530931f7488ebee211ce70e40c6d39
SHA512 65428a4da61d5975364b1f343e0cdcf3ee8f7ce7ce3d67e1b37d4d5740ea847ddea4c0997243191307fd182b3793e8de6360c322a553e7148287c4be3c23d9ec
SSDEEP 6144:SQzqgXdmgYUvlNy7YqFWr7BtCWhs2iJyso+6QS9kgRPkm18KnY:xdy7Y3tCWe2K++6h9kgRPSK
TLSH
T148849D15F7A514F9E2778134C9626507DB723C8E07A0EACB13A88F961F336D09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hrx.exe

File Explorer

hrx.exe

.exe 383KB

hrx.exe

IMPHASH 2355536e5fd7b95eac98a737f138f93f
SHA256 b27905e17203e0e343ec2e3d6b5cd34105b42027ad6bfd1242e4c299d41e663c
MD5 863b5af0695b74d7c79ea5433b4773a5
SHA1 02cc42f823530931f7488ebee211ce70e40c6d39
SHA512 65428a4da61d5975364b1f343e0cdcf3ee8f7ce7ce3d67e1b37d4d5740ea847ddea4c0997243191307fd182b3793e8de6360c322a553e7148287c4be3c23d9ec
SSDEEP 6144:SQzqgXdmgYUvlNy7YqFWr7BtCWhs2iJyso+6QS9kgRPkm18KnY:xdy7Y3tCWe2K++6h9kgRPSK
TLSH
T148849D15F7A514F9E2778134C9626507DB723C8E07A0EACB13A88F961F336D09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

128444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA LoadCursorA GetWindowThreadProcessId SetWindowLongPtrA GetWindowLongPtrA FillRect GetCursorPos SetCursor ShowCursor EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState SetLayeredWindowAttributes ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcA PostMessageA PeekMessageA TranslateMessage

gdi32

Polygon TextOutW TextOutA MoveToEx SetTextColor SetBkMode SelectObject Rectangle LineTo GetStockObject Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

msimg32

AlphaBlend

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers ReadFile SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW IsValidLocale GetLocaleInfoW Beep CloseHandle OpenProcess GetTickCount64 ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime RtlUnwind GetModuleHandleW WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead LCMapStringW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hrx.exe

user32

gdi32

msimg32

kernel32

generic