dollar[.]exe | Triage™

General

Target
dollar.exe
Size 538KB
Sample260909-ake9aaac26
SHA256 a75d32c6eba92012707da7a2ad8b800f4ab081947aa7b793ae14d7348fd2d27b
MD5 080147ed04c5a1e16cd85f975aa4fdab
SHA1 a20cc329748f9ea497397f526a05f918d7a6abba
SHA512 70742bff4ec19e8fec0296e47adf5f158805f5217e4533f2a28221a6b1ad6bb1dbecc83454b8ec9d68f27d30f6e7483ada31170960d7111b533c4eeb60c318e8
SSDEEP 12288:U6W+8ztB5Z5LWUamuri3Ii04UnUNZ+xVJ5:jG5ZVlag3504UUP+F5
TLSH
T1C2C4F111F69540F5D026C5B9886285B1E6B2B8517F61CEEF03B006573F27AD4AF3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dollar.exe

File Explorer

dollar.exe

.exe 538KB

dollar.exe

IMPHASH fc746f1568e4343a2a7ada2dbccb48ab
SHA256 a75d32c6eba92012707da7a2ad8b800f4ab081947aa7b793ae14d7348fd2d27b
MD5 080147ed04c5a1e16cd85f975aa4fdab
SHA1 a20cc329748f9ea497397f526a05f918d7a6abba
SHA512 70742bff4ec19e8fec0296e47adf5f158805f5217e4533f2a28221a6b1ad6bb1dbecc83454b8ec9d68f27d30f6e7483ada31170960d7111b533c4eeb60c318e8
SSDEEP 12288:U6W+8ztB5Z5LWUamuri3Ii04UnUNZ+xVJ5:jG5ZVlag3504UUP+F5
TLSH
T1C2C4F111F69540F5D026C5B9886285B1E6B2B8517F61CEEF03B006573F27AD4AF3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

47552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oltoonds.pdb

kernel32

GetLastError GetProcessHeap HeapFree SetFileInformationByHandle IsValidCodePage IsDBCSLeadByte GetProcessHeaps TryAcquireSRWLockExclusive GetStdHandle GetProcAddress ReleaseSRWLockExclusive GetCurrentThread GetTickCount GetSystemTimeAsFileTime GetTickCount64 QueryPerformanceFrequency MultiByteToWideChar WaitForSingleObject CloseHandle GetModuleHandleA GetConsoleMode WriteConsoleW GetCPInfo IsThreadAFiber GetThreadId GetSystemWindowsDirectoryW GetCurrentDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx HeapReAlloc HeapAlloc CreateFileW SetFileTime SetLastError GetFullPathNameW LoadLibraryA SetFilePointerEx GetConsoleOutputCP FlushFileBuffers HeapSize QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW WriteFile

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

user32

GetCaretBlinkTime GetSysColor GetMessageExtraInfo GetShellWindow

Sharing