Firstrunner[.]exe | Triage™

General

Target
Firstrunner.exe
Size 698KB
Sample260919-p4ppds1bkd
SHA256 881cfbdf9bdd614ec1728059c6aaf9468b3471f38e03df234d0bf28ed1c1de15
MD5 5ac60a7ae01eb945facb9c09820d1a31
SHA1 5e79467306b97f14eeff1055389e88b59fc95544
SHA512 6106f484c41163a9097a3f70f34e8226d3508aaaaef91f626777271aad149772b9b31e8a4deef8abc73715676cd20f669347b0a703b0712d2c09ec42ef8978d4
SSDEEP 12288:4vDPnl9zX4uJsp+GzsjehLxdhzXoZhk+e7LzwPtto4ZHu7TV+hXb6G4XcvqR1F05:4jnlFPKVzs8LKZh8/ziq4pETV6WG4Xc1
TLSH
T154E4F10AFE9102E4C8515378948586226FB23C5C87ADEBEF13A1457D7E7A2D00DBF792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Firstrunner.exe

File Explorer

Firstrunner.exe

.exe 698KB

Firstrunner.exe

IMPHASH 096dc973b70dedfe5f895c827bb869c5
SHA256 881cfbdf9bdd614ec1728059c6aaf9468b3471f38e03df234d0bf28ed1c1de15
MD5 5ac60a7ae01eb945facb9c09820d1a31
SHA1 5e79467306b97f14eeff1055389e88b59fc95544
SHA512 6106f484c41163a9097a3f70f34e8226d3508aaaaef91f626777271aad149772b9b31e8a4deef8abc73715676cd20f669347b0a703b0712d2c09ec42ef8978d4
SSDEEP 12288:4vDPnl9zX4uJsp+GzsjehLxdhzXoZhk+e7LzwPtto4ZHu7TV+hXb6G4XcvqR1F05:4jnlFPKVzs8LKZh8/ziq4pETV6WG4Xc1
TLSH
T154E4F10AFE9102E4C8515378948586226FB23C5C87ADEBEF13A1457D7E7A2D00DBF792
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

62032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spualdiaoys.pdb

kernel32

WriteConsoleW GetLastError SetLastError WaitForSingleObject CloseHandle GetStdHandle GetConsoleMode ReleaseSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThread GetTempPathW GetSystemDirectoryW GetSystemWindowsDirectoryW GetWindowsDirectoryW MultiByteToWideChar GetACP GetTickCount GetOEMCP GetSystemInfo GetVersion QueryPerformanceFrequency LoadLibraryA GetProcAddress GetProcessHeap HeapFree HeapAlloc GetThreadLocale GetUserDefaultLCID GetConsoleOutputCP GetUserDefaultUILanguage LCMapStringW GetSystemDefaultLangID GetConsoleCP GetConsoleWindow GetStringTypeW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW SetFileTime CreateFileW GetFileType IsValidCodePage GetCPInfo GetSystemTimeAsFileTime GetTickCount64 GetSystemDefaultLCID HeapReAlloc SetFileInformationByHandle GetModuleHandleA SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle VirtualProtect LoadLibraryExW CompareStringW HeapSize FlushFileBuffers WriteFile

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

Sharing