xpran[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xpran.exe
Size 174KB
Sample260910-wn234seq8z
SHA256 64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9
MD5 25fafb261c4f06a390e93a03ce194e94
SHA1 88a16946db25adc1bcc1a7d5dc72e0a3141bc4b4
SHA512 7ca825082d3e6141425c91b71eb526c2bb5e5b5219209aa40c70fd9d918c1287ec5510b145b4a17a7041e13c204ca6a729e16d28a869906ee61f94360f85c09d
SSDEEP 3072:SyfkbMj7Vrp09Ddbk+Vy3KJT5j3jQsrLXWNzX4Ug8pb10:SyfdT09xjVprkaL9x+h0
TLSH
T137046C16B7A511FAE0778178C9A20705F776B8250770ABEF03A04376AF276D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xpran.exe

File Explorer

xpran.exe

.exe 174KB

xpran.exe

IMPHASH ecea2caccc740174be13eb9cd79ad012
SHA256 64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9
MD5 25fafb261c4f06a390e93a03ce194e94
SHA1 88a16946db25adc1bcc1a7d5dc72e0a3141bc4b4
SHA512 7ca825082d3e6141425c91b71eb526c2bb5e5b5219209aa40c70fd9d918c1287ec5510b145b4a17a7041e13c204ca6a729e16d28a869906ee61f94360f85c09d
SSDEEP 3072:SyfkbMj7Vrp09Ddbk+Vy3KJT5j3jQsrLXWNzX4Ug8pb10:SyfdT09xjVprkaL9x+h0
TLSH
T137046C16B7A511FAE0778178C9A20705F776B8250770ABEF03A04376AF276D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

dasd

Minor OS version

Major OS version

Entry point

18496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA FillRect SetCursor GetClientRect EndPaint BeginPaint SetForegroundWindow UpdateWindow DrawTextA GetSystemMetrics BringWindowToTop SetWindowPos ShowWindow CreateWindowExA RegisterClassA DefWindowProcA PeekMessageA TranslateMessage

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA

gdi32

GetStockObject SetBkMode CreateSolidBrush CreatePen CreateFontA LineTo SelectObject SetTextColor DeleteObject MoveToEx

shell32

ShellExecuteA

kernel32

WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CreateFileW WriteConsoleW MultiByteToWideChar GetStartupInfoW GetACP IsValidCodePage CreateFileA FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileSize GetLogicalDrives ReadFile WriteFile Beep CloseHandle Sleep TerminateProcess OpenProcess GetTickCount GetModuleFileNameA GetModuleHandleA MoveFileA GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW FindNextFileW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW SetFilePointerEx FindFirstFileExW

Name

.text

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xpran.exe

user32

advapi32

gdi32

shell32

kernel32

generic