Extend_01[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Extend_01.exe
Size 768KB
Sample260910-pp5gasgh54
SHA256 7f7969a228079aa00ba24ecc6ec6958e62acd08206cbcc9f5efa2a34550e66ba
MD5 69c7e940be8fa46da7efd3760c5f3810
SHA1 b4a7462e1ba4a292560d3ea2c2b4774a5263bd6c
SHA512 9c1702977defe150e63744fe923f7413cd1f717bcc164b0ea12f5b2439a4e638da336cdd843dda9e48535a87ddbef9b2cd9cb7922014051ea57da82b3cd0cf19
SSDEEP 12288:OQ7nkmzIrVVyzxM/4C4Wya63Heu0Nae3WxnVi3F:OQ7nXIhVy9M/nGu/3D3F
TLSH
T195F44B22B585BCB2E1B1017167BF5BFA8B2CED211715C4DFA3C009699A7C0D3363679A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Extend_01.exe

File Explorer

Extend_01.exe

.exe 768KB

Extend_01.exe

IMPHASH 857afdf6d48cbb2777ecadd962c59b7a
SHA256 7f7969a228079aa00ba24ecc6ec6958e62acd08206cbcc9f5efa2a34550e66ba
MD5 69c7e940be8fa46da7efd3760c5f3810
SHA1 b4a7462e1ba4a292560d3ea2c2b4774a5263bd6c
SHA512 9c1702977defe150e63744fe923f7413cd1f717bcc164b0ea12f5b2439a4e638da336cdd843dda9e48535a87ddbef9b2cd9cb7922014051ea57da82b3cd0cf19
SSDEEP 12288:OQ7nkmzIrVVyzxM/4C4Wya63Heu0Nae3WxnVi3F:OQ7nXIhVy9M/nGu/3D3F
TLSH
T195F44B22B585BCB2E1B1017167BF5BFA8B2CED211715C4DFA3C009699A7C0D3363679A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\xwork_vs2015\RetentionSoftware\bin\broex.pdb

kernel32

WideCharToMultiByte CreateDirectoryW FindFirstFileA FindClose GetPrivateProfileStringA ReadFile MultiByteToWideChar VirtualAlloc VirtualProtect GetModuleHandleW LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA WritePrivateProfileStringW GetPrivateProfileStringW GetLocalTime CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot ExitProcess GetCurrentProcess LocalFree GetCommandLineW SetCurrentDirectoryW VirtualFree GetModuleFileNameW HeapSize SetEndOfFile GetFileAttributesExW WriteConsoleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep SleepEx GetTickCount WaitForSingleObject FreeLibrary GetLastError WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA SetLastError FormatMessageA VerSetConditionMask GetSystemDirectoryA VerifyVersionInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetFilePointerEx WriteFile GetACP GetConsoleMode ReadConsoleW GetConsoleCP HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW GetTimeZoneInformation HeapReAlloc GetCurrentDirectoryW GetFullPathNameW SetStdHandle FlushFileBuffers DecodePointer FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap

user32

GetWindowThreadProcessId GetShellWindow GetDesktopWindow GetWindowRect GetForegroundWindow GetSystemMetrics

advapi32

CryptAcquireContextA RegOpenKeyExW RegCloseKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptReleaseContext

shell32

SHGetSpecialFolderPathW CommandLineToArgvW

shlwapi

PathRemoveFileSpecW PathIsDirectoryW

ws2_32

WSAIoctl socket freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname setsockopt htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup getaddrinfo ntohs

wldap32

ord200 ord30 ord79 ord35 ord301 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord33 ord143

Name

.text

Size

539KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

428B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Extend_01.exe

kernel32

user32

advapi32

shell32

shlwapi

ws2_32

wldap32

generic