GoldenMacro(9)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GoldenMacro(9).exe
Size 438KB
Sample260919-2rlhest18n
SHA256 9ca9ea2bd89474505652946e359ba2c4d5647d05793794992cb9b260e075984c
MD5 8563d7525d7ee6f73a6acc4b226adca0
SHA1 1dd61ef2e2bc4d9c62968adaa3e9827e92a54e4d
SHA512 55c58d40a4b840538e1d5dffa1658487fbdcbb8c1e0a0dd4d4f0b1540dd16ad5aeb5f09f69f66859d66931bfa42fe8bb75083b7661827bde78e8051146e3f986
SSDEEP 12288:NApfCD11uSYbRb/Lbsb+9PZUsZMb/b0bVxbDTbDbCbXmb467ITgr:NAtC8Z
TLSH
T163947C71E7A150B9F467C17C9A964A02F771B4036350D6EB33AC19982F8FAD0893FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GoldenMacro(9).exe

File Explorer

GoldenMacro(9).exe

.exe 438KB

GoldenMacro(9).exe

IMPHASH 6d254459033d384ffbb919581354c261
SHA256 9ca9ea2bd89474505652946e359ba2c4d5647d05793794992cb9b260e075984c
MD5 8563d7525d7ee6f73a6acc4b226adca0
SHA1 1dd61ef2e2bc4d9c62968adaa3e9827e92a54e4d
SHA512 55c58d40a4b840538e1d5dffa1658487fbdcbb8c1e0a0dd4d4f0b1540dd16ad5aeb5f09f69f66859d66931bfa42fe8bb75083b7661827bde78e8051146e3f986
SSDEEP 12288:NApfCD11uSYbRb/Lbsb+9PZUsZMb/b0bVxbDTbDbCbXmb467ITgr:NAtC8Z
TLSH
T163947C71E7A150B9F467C17C9A964A02F771B4036350D6EB33AC19982F8FAD0893FB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

user32

GetWindowTextW GetCursorPos ShowWindow ReleaseCapture PostQuitMessage GetClientRect GetMessageW DefWindowProcW MapVirtualKeyW SetProcessDpiAwarenessContext DestroyWindow GetDC SetWindowPos CreateWindowExW ScreenToClient SendMessageW CallNextHookEx GetSystemMetrics RegisterClassExW GetWindowPlacement SetWindowsHookExW DispatchMessageW SetWindowPlacement SetWindowDisplayAffinity GetForegroundWindow UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW GetClassNameW SendInput

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetPixel CreateSolidBrush BitBlt

winmm

timeBeginPeriod timeEndPeriod

kernel32

IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetACP LCMapStringW VirtualProtect GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType FlsFree FlsSetValue CreateDirectoryW GetModuleFileNameA SizeofResource CreateSemaphoreExW HeapFree SetLastError SetStdHandle GetStdHandle ReleaseSemaphore WriteFile GetModuleHandleExW SetConsoleMode GetModuleFileNameW CreateMutexA WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetConsoleMode FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx LockResource QueryPerformanceFrequency OpenSemaphoreW CloseHandle FreeConsole LoadResource FindResourceW HeapAlloc GetLocalTime SwitchToThread GetProcAddress CreateMutexExW GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte DebugBreak QueryPerformanceCounter GetTickCount AllocConsole IsDebuggerPresent GetFileAttributesW OutputDebugStringA LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW FlsGetValue GetStringTypeW ReadFile ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile SetConsoleTitleA FlsAlloc ExitProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread

advapi32

RegGetValueW RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey

ole32

CoTaskMemFree

Name

.text

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GoldenMacro(9).exe

dwmapi

user32

gdi32

winmm

kernel32

advapi32

ole32

generic