123[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
123.exe
Size 108KB
Sample260916-tdtmwadj4v
SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
MD5 8ce68a756995deb55746dee1525edec3
SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
TLSH
T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

123.exe

.exe 108KB

123.exe

IMPHASH 6be0d54d77bd5af43bdc49e77ffdcbb1
SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
MD5 8ce68a756995deb55746dee1525edec3
SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
TLSH
T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d9:b2:30:f3:fd:07:fc:a7:45:9a:50:85:3d:76:b5:a7:78:28:3e:06:42:b9:8c:d2:59:bf:8d:7d:87:38:17:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Chains

Nov 3, 2022

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Serial Number

0e:c6:f2:b2:76:a1:46:a0:7d:0e:6d:93:57:b5:e1:08

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 10, 2021 - Aug 10, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

43824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-20735119\bora-vmsoft\build\release-x64\tools-for-windows\Win32\services\vmtoolsd\vmtoolsd.pdb

advapi32

AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner SetEntriesInAclW RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx DeregisterEventSource RegisterEventSourceW ReportEventW RegCreateKeyW RegSetValueExW CreateServiceW DeleteService RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

ole32

CoUninitialize

user32

GetWindowLongPtrW SetWindowLongPtrW GetSystemMetrics UnregisterClassW GetDesktopWindow RegisterDeviceNotificationW UnregisterDeviceNotification MessageBoxW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW PeekMessageW TranslateMessage DispatchMessageW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

WSCInstallProvider64_32 WSAStartup WSCEnumProtocols WSACleanup

intl

libintl_gettext

glib-2.0

g_main_loop_run g_main_loop_unref g_source_remove g_timeout_add g_key_file_new g_key_file_free g_key_file_get_keys g_strdup_printf g_strfreev g_strcmp0 g_array_new g_array_free g_array_append_vals g_strchomp g_ptr_array_free g_key_file_get_integer g_ptr_array_remove_index g_ptr_array_add g_ptr_array_sort g_dir_open g_dir_read_name g_dir_close g_file_test g_main_context_default g_main_loop_new g_option_group_set_error_hook g_option_context_get_main_group g_main_context_unref g_stat g_rand_int_range g_rand_free g_rand_new g_key_file_load_from_file g_build_filename g_cond_wait g_get_monotonic_time g_main_loop_quit g_source_destroy g_cond_wait_until g_cond_signal g_snprintf g_atomic_int_add g_queue_new g_atomic_int_set g_key_file_get_boolean g_thread_pool_set_max_idle_time g_thread_pool_set_max_unused_threads g_thread_pool_push g_thread_pool_free g_main_loop_is_running g_thread_pool_new g_queue_delete_link g_queue_remove g_queue_pop_tail g_malloc g_queue_push_head g_queue_find_custom g_queue_free g_option_context_parse g_win32_error_message g_main_loop_get_context g_ptr_array_new g_source_unref g_source_attach g_source_set_callback g_idle_add g_log g_logv g_str_has_prefix g_clear_error g_file_get_contents g_free g_malloc0 g_print g_printerr g_option_context_new g_option_context_set_summary g_option_context_free g_idle_add_full g_mutex_unlock g_mutex_lock g_mutex_clear g_mutex_init g_thread_join g_thread_try_new g_ptr_array_remove g_strdup g_str_has_suffix g_return_if_fail_warning g_option_context_add_main_entries

gmodule-2.0

g_module_open g_module_symbol g_module_make_resident g_module_error g_module_close

gobject-2.0

g_object_notify g_object_class_install_property g_signal_new g_cclosure_marshal_VOID__POINTER g_type_check_class_cast g_type_check_instance_cast g_type_register_static g_type_class_peek_parent g_value_get_boolean g_object_unref g_object_get g_object_set g_object_new g_signal_connect_data g_signal_lookup g_type_init g_signal_emit_by_name g_value_set_boolean g_value_set_uint g_value_get_uint g_value_set_pointer g_value_peek_pointer g_value_get_pointer g_signal_parse_name g_param_spec_pointer

vmtools

File_UnlinkIfExists GuestStoreClient_GetContent VMTools_ConfigGetBoolean VMTools_WriteConfig VMTools_CompareConfig Win32U_RegQueryValueEx Win32U_RegOpenKeyEx BackdoorChannel_New VMTools_CreateTimer RpcChannel_New RpcChannel_SetRetVals RpcChannel_Setup StrUtil_GetNextToken GuestApp_GetConfPath GuestApp_GetInstallPath RpcChannel_RegisterCallback Win32U_FormatMessage Win32U_SetEnvironmentVariable Win32U_GetEnvironmentVariable GuestStoreClient_DeInit GuestStoreClient_Init RpcChannel_Send RpcChannel_Start Str_Snwprintf VMTools_SuspendLogIO File_MakeSafeTemp VMTools_ConfigGetInteger VMTools_AddConfig VMTools_LoadConfig VMTools_GetString VmCheck_IsVirtualWorld Str_SafeAsprintf RpcChannel_SendOne VMTools_BindTextDomain VMTools_TeardownVmxGuestLog VMTools_SetupVmxGuestLog Str_Wcscpy VMTools_UseVmxGuestLog Str_Vaswprintf VMTools_ConfigLogging Str_SafeVaswprintf Str_Aswprintf Hostinfo_GetOSType CodeSet_Utf8ToUtf16le Unicode_InitW Panic RpcChannel_Destroy RpcChannel_Stop VMTools_NewHandleSource Str_Vasprintf VMTools_AttachConsole VMTools_ResumeLogIO vm_free VMTools_ConfigGetString

kernel32

CloseHandle GetLastError SetErrorMode SetEvent WaitForSingleObject CreateEventW GetCurrentProcess GetCurrentThread SetThreadPriority SetPriorityClass GetModuleHandleW GetProcAddress LocalFree SetDllDirectoryW VerifyVersionInfoW SetConsoleCtrlHandler OpenEventW SetLastError ResetEvent Sleep WaitForMultipleObjects LocalAlloc OutputDebugStringA OutputDebugStringW FreeLibrary GetModuleFileNameW LoadLibraryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter VerSetConditionMask TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr _CxxThrowException __std_exception_destroy __std_exception_copy memset __C_specific_handler __current_exception __current_exception_context _purecall

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

exit terminate _errno strerror _crt_atexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-string-l1-1-0

strncmp _wcsicmp strcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vswprintf _close __stdio_common_vfwprintf __p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

generic

count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=30034,

count=1, id=253, version=28518,

count=2, id=257, productName=VS2019 v16.11.1 build 30133, version=30133,

count=6, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,

count=2, id=257, productName=VS2019 v16.2.3 build 27905, version=27905,

count=25, id=261, version=30034,

count=10, id=260, version=30034,

count=3, id=259, version=30034,

count=13, id=257, version=28900,

count=317, id=1, productName=Unmarked objects,

count=11, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,

count=2, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,