leash[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
leash.exe
Size 958KB
Sample260909-e2j11sbl8t
SHA256 e7874e48db2cf3f8e5757df8e7bbc9b832072e6465c5696e3861d966837c1d7b
MD5 5ccb791545dac18d36cf809b147d4fb8
SHA1 e1621f739d31cbc2257ce3b3cc0e52f1823dec7d
SHA512 ccdbb08d0cc45ed5408bceb08f61ef033e899874a43e14386c08b6bc33aae679020245b102125c1df149961f68d200667e4a42413738ca9bfe2479afa31e0622
SSDEEP 12288:rxWvf0npHMNVaAJxUp8DiLaAOIX7cvakQfhxUp8DG/TI1Akvcc4x2LqFDf:YEnpHPqmL1x3Nccs
TLSH
T11D259D13F712435DD21A6C78CA61C394B3327C50AF16D28FB9A93BA08D9B5F04EE96D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
leash.exe

File Explorer

leash.exe

.exe 958KB

leash.exe

IMPHASH 319dfafabf62fb936247eba53b2bad53
SHA256 e7874e48db2cf3f8e5757df8e7bbc9b832072e6465c5696e3861d966837c1d7b
MD5 5ccb791545dac18d36cf809b147d4fb8
SHA1 e1621f739d31cbc2257ce3b3cc0e52f1823dec7d
SHA512 ccdbb08d0cc45ed5408bceb08f61ef033e899874a43e14386c08b6bc33aae679020245b102125c1df149961f68d200667e4a42413738ca9bfe2479afa31e0622
SSDEEP 12288:rxWvf0npHMNVaAJxUp8DiLaAOIX7cvakQfhxUp8DG/TI1Akvcc4x2LqFDf:YEnpHPqmL1x3Nccs
TLSH
T11D259D13F712435DD21A6C78CA61C394B3327C50AF16D28FB9A93BA08D9B5F04EE96D4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwrite

DWriteCreateFactory

user32

TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage MessageBoxA LoadCursorA GetCursorPos GetWindowRect GetSystemMetrics ReleaseCapture SetCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

shlwapi

PathRemoveFileSpecW

kernel32

WriteConsoleW LeaveCriticalSection SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap LCMapStringW LoadLibraryExW VirtualProtect QueryPerformanceCounter QueryPerformanceFrequency CreateFileW WriteFile CloseHandle GetFileAttributesW GetModuleFileNameW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

803KB

Virtual Size

802KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

leash.exe

d3d11

d3dcompiler_47

dcomp

dwrite

user32

ole32

shlwapi

kernel32

generic