xxxx[.]exe | Triage™

General

Target
xxxx.exe
Size 306KB
Sample260912-taw9labn21
SHA256 0c276ad47d5f35950246c5beebdf5a7d8aa2c945f1d42391c48be6fad56202e3
MD5 5e56d03ad8eddb1b80cbc71b0b14fe1f
SHA1 70f4fd5022e3c47bd1962503c226c4c65aae3b18
SHA512 00e9ce98fe2bfce8a61f1cf2d5e951c7f77920be9b865bb5a824d94f03c59ac60a5e9e7de13ff65f95e94d621d9516f78497a1d76048c6e457603ffd3e5d7a7e
SSDEEP 3072:u7QJRmgTdCjIw7qR8mkdQBH06khiF6EqpucLAYZp1MaXmJGzkLW3srmJk8HYw/BI:oQLZYIt+6U6eiF6EqJkS3QChq
TLSH
T126646D16F7A514FAE977C13DCD424902DA72BC4647A1E6CF13904A963F236E09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xxxx.exe

File Explorer

xxxx.exe

.exe 306KB

xxxx.exe

IMPHASH ffc2d5de0f1b70bee570cda13229add0
SHA256 0c276ad47d5f35950246c5beebdf5a7d8aa2c945f1d42391c48be6fad56202e3
MD5 5e56d03ad8eddb1b80cbc71b0b14fe1f
SHA1 70f4fd5022e3c47bd1962503c226c4c65aae3b18
SHA512 00e9ce98fe2bfce8a61f1cf2d5e951c7f77920be9b865bb5a824d94f03c59ac60a5e9e7de13ff65f95e94d621d9516f78497a1d76048c6e457603ffd3e5d7a7e
SSDEEP 3072:u7QJRmgTdCjIw7qR8mkdQBH06khiF6EqpucLAYZp1MaXmJGzkLW3srmJk8HYw/BI:oQLZYIt+6U6eiF6EqJkS3QChq
TLSH
T126646D16F7A514FAE977C13DCD424902DA72BC4647A1E6CF13904A963F236E09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

62400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\David Zuck\Desktop\blade ball\cpp\tb\build\Release\tb.pdb

kernel32

FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetStdHandle GetConsoleCursorInfo SetConsoleCursorInfo FillConsoleOutputAttribute QueryFullProcessImageNameW SetConsoleCursorPosition GetExitCodeProcess Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcmpiW GetProcessTimes WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP RtlUnwind

user32

MapVirtualKeyA GetKeyNameTextA GetAsyncKeyState SendInput VkKeyScanA

winmm

timeBeginPeriod timeEndPeriod

Name

.text

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xxxx.exe

kernel32

user32

winmm

generic