win32[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
win32.exe
Size 3.5MB
Sample260916-swm3dacq3x
SHA256 b9f415ac33fedd6e400f770e1a006656352ed618303601e111c8629194c05fee
MD5 8c828c1f49434fbc39e86320259b34b6
SHA1 3ac4e29245d6dc6e7f430cda1fda39188ea8f353
SHA512 e8a15068b7272f4d136c1a6d9272a24c03bfdeb0d2e7bae1a1a8d26d540ffa7246364e43c38380d33bd5d4ee42db7830845260e099bf0a2609021a7f27930ca6
SSDEEP 98304:bUclFWMao9uqdMvTmq2notmVPjCY1k6vq329iu/jS:pKMv9PICDoMMY1kL29V/j
TLSH
T16406F106B36782ACD12768389AA2E31BE33178241F2743C773F545659FEB6D14EB6342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
win32.exe

File Explorer

win32.exe

.exe 3.5MB

win32.exe

IMPHASH ede14f31c4e70f51805c538d25da5bf7
SHA256 b9f415ac33fedd6e400f770e1a006656352ed618303601e111c8629194c05fee
MD5 8c828c1f49434fbc39e86320259b34b6
SHA1 3ac4e29245d6dc6e7f430cda1fda39188ea8f353
SHA512 e8a15068b7272f4d136c1a6d9272a24c03bfdeb0d2e7bae1a1a8d26d540ffa7246364e43c38380d33bd5d4ee42db7830845260e099bf0a2609021a7f27930ca6
SSDEEP 98304:bUclFWMao9uqdMvTmq2notmVPjCY1k6vq329iu/jS:pKMv9PICDoMMY1kL29V/j
TLSH
T16406F106B36782ACD12768389AA2E31BE33178241F2743C773F545659FEB6D14EB6342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

748228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\SystemX\Desktop\тригач + визуалы + мапер\рейдж\сурс rage mp\main\FiveM-External\x64\Release\dotnet472-known-issues.pdb

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter LoadLibraryW GetModuleHandleW Process32First OpenProcess CreateToolhelp32Snapshot K32GetModuleBaseNameW Process32Next Module32FirstW lstrcmpiA Module32NextW K32EnumProcessModules GetLastError GetTickCount InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind CreateProcessA OutputDebugStringA WakeAllConditionVariable SleepConditionVariableSRW GetPrivateProfileIntA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree MultiByteToWideChar GetTickCount64 GetComputerNameA RtlCaptureContext GetPrivateProfileStringA CreateDirectoryA WritePrivateProfileStringA CreateFileA MoveFileExA GetTempPathA Sleep TerminateProcess WriteFile GetCurrentProcess GetModuleFileNameA K32GetDeviceDriverBaseNameA DeleteFileA GetVolumeInformationA GetEnvironmentVariableA GetTempPathW K32EnumDeviceDrivers GetCurrentProcessId GetProcAddress CloseHandle GetModuleHandleA GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl RtlLookupFunctionEntry VirtualFree

user32

IsWindowVisible EnumWindows SetCursorPos GetClassNameW FindWindowA GetWindowThreadProcessId DestroyWindow SetWindowPos FindWindowW ReleaseCapture IsWindowUnicode SetCursor SetCapture RegisterClassExW ShowWindow IsWindow SetWindowLongA GetWindowLongA SetWindowDisplayAffinity DefWindowProcA GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState DefWindowProcW PeekMessageA TranslateMessage DispatchMessageA SetProcessDpiAwarenessContext IsIconic UpdateWindow RegisterClassExA PostQuitMessage UnregisterClassA GetWindowDisplayAffinity SetLayeredWindowAttributes CreateWindowExA GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetSystemMetrics GetClientRect GetKeyNameTextA GetAsyncKeyState MapVirtualKeyA MapVirtualKeyW GetForegroundWindow SendInput

advapi32

RegEnumValueA RegDeleteValueA RegEnumKeyExA OpenServiceA OpenProcessToken GetTokenInformation RegSetKeyValueW RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegOpenKeyExA RegSetValueExA ControlService RegCreateKeyExA OpenSCManagerA LookupPrivilegeValueA RegQueryValueExA CloseServiceHandle AdjustTokenPrivileges RegDeleteTreeA

shell32

ShellExecuteW ShellExecuteA

msvcp140

??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z

ntdll

NtQuerySystemInformation RtlInitUnicodeString

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memcpy memcmp memchr strchr __std_terminate wcsstr memmove __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsscanf _wfopen fgetc __stdio_common_vfprintf __acrt_iob_func fwrite fgetpos setvbuf fseek ftell __stdio_common_vsprintf fflush __p__commode fsetpos ungetc _set_fmode __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fputc

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _exit exit _c_exit _register_thread_local_exe_atexit_callback _beginthreadex _seh_filter_exe terminate _cexit _errno abort _invoke_watson _crt_atexit _register_onexit_function _get_narrow_winmain_command_line _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _set_app_type

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wremove _unlock_file

api-ms-win-crt-string-l1-1-0

_stricmp strncmp strcmp toupper towlower strncpy strncpy_s tolower iswalnum isalnum

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol atof

api-ms-win-crt-math-l1-1-0

powf logf sinf log sqrtf fmodf fmod asinf cosf ceilf atan2f roundf ldexp acosf __setusermatherr pow

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale