dx11[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dx11.exe
Size 200KB
Sample260910-pk3rxawxe1
SHA256 eca839a2ea6b2a2d3172cfe1ed0d944dcf2256fa07d7518aa4416d3d5043bd1e
MD5 85d4e6f8852938c677dcbe176e4246fd
SHA1 c9ca14b328f1bb33d64e318480860e4c2ee007ea
SHA512 2d168dd5013e017df0eccdba07c5850b54005f2434a33c1695066dd6bf01bcab62348178716a9b4298ea37cf5e92702a8031474f176385ac44b483a06daa24f1
SSDEEP 6144:PfIOlU0Y/Jx9G89ca6k6Fnj5TObqpecYdBFyHPzLwq+gKM:HGbvmLwq5K
TLSH
T178144A1AAA550138E5A7C179CED68843FB733C4D0B35D9EB03905AB25E73AD0AE39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dx11.exe

File Explorer

dx11.exe

.exe 200KB

dx11.exe

IMPHASH 6eccac71c6dc46904283ec1ea997af2b
SHA256 eca839a2ea6b2a2d3172cfe1ed0d944dcf2256fa07d7518aa4416d3d5043bd1e
MD5 85d4e6f8852938c677dcbe176e4246fd
SHA1 c9ca14b328f1bb33d64e318480860e4c2ee007ea
SHA512 2d168dd5013e017df0eccdba07c5850b54005f2434a33c1695066dd6bf01bcab62348178716a9b4298ea37cf5e92702a8031474f176385ac44b483a06daa24f1
SSDEEP 6144:PfIOlU0Y/Jx9G89ca6k6Fnj5TObqpecYdBFyHPzLwq+gKM:HGbvmLwq5K
TLSH
T178144A1AAA550138E5A7C179CED68843FB733C4D0B35D9EB03905AB25E73AD0AE39713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

141624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\source\repos\Tools\x64\Release\Tools.pdb

kernel32

GetLastError DeleteFileW CloseHandle LoadLibraryW GetProcAddress LocalFree GetFileSize GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW Sleep CopyFileW WideCharToMultiByte GetConsoleWindow GetTickCount IsDebuggerPresent MultiByteToWideChar InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SetFileAttributesW ReleaseMutex GetFileAttributesW CreateFileW WaitForSingleObject FindClose CreateMutexW GetTempPathW GetModuleFileNameW WriteFile GetCurrentProcess FindNextFileW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCommandLineW FindFirstFileW GetModuleHandleW ReadFile

user32

ShowWindow

advapi32

RegQueryValueExW RegSetValueExW SetNamedSecurityInfoW SetEntriesInAclW RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW

ole32

CoUninitialize CoInitialize

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ?_Throw_Cpp_error@std@@YAXH@Z

crypt32

CryptStringToBinaryA CryptUnprotectData

shlwapi

PathFindFileNameW PathFindExtensionW

bcrypt

BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptSetProperty BCryptDestroyHash BCryptHashData

iphlpapi

GetAdaptersAddresses

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __current_exception_context memmove __C_specific_handler memset memcpy memcmp strchr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vswprintf_s _set_fmode

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscpy_s iswspace iswdigit

api-ms-win-crt-runtime-l1-1-0

_exit _c_exit _seh_filter_exe _invoke_watson _cexit _beginthreadex exit _register_thread_local_exe_atexit_callback _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _configure_narrow_argv _get_narrow_winmain_command_line _initterm _set_app_type

api-ms-win-crt-convert-l1-1-0

atol _wtoi

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale