speed2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
speed2.exe
Size 5.6MB
Sample260920-2x79dat1fy
SHA256 caf955d2c1bd7602d519f0890b63e7cca8dd793d579d77dae62baf59e5d635fc
MD5 a5a5a02b68fffeaad6b2d8893d5081aa
SHA1 c0ad50ea443a4a971fabfca56c3828c88b421191
SHA512 4ecb49dcf0e23e84b5d265fc1b742374b61198273d8e7e475c2c7f45994a87e83c6fd0b53e3274560b4e25f08efc1206a6a858b1f6de90bc2bcf9d65c5eeb68a
SSDEEP 98304:zvYzradVmDrtRiy1XE4So2DZfJ1Cl9tGCR:0zlh1GhytGC
TLSH
T1A256CF01F29341B1C8461674589B7B7AA77CDF49433E8BC3F7E4FD291E31660A52A28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
speed2.exe

File Explorer

speed2.exe

.exe 5.6MB

speed2.exe

IMPHASH 39d70623cd89378e2fa303ee76e5da72
SHA256 caf955d2c1bd7602d519f0890b63e7cca8dd793d579d77dae62baf59e5d635fc
MD5 a5a5a02b68fffeaad6b2d8893d5081aa
SHA1 c0ad50ea443a4a971fabfca56c3828c88b421191
SHA512 4ecb49dcf0e23e84b5d265fc1b742374b61198273d8e7e475c2c7f45994a87e83c6fd0b53e3274560b4e25f08efc1206a6a858b1f6de90bc2bcf9d65c5eeb68a
SSDEEP 98304:zvYzradVmDrtRiy1XE4So2DZfJ1Cl9tGCR:0zlh1GhytGC
TLSH
T1A256CF01F29341B1C8461674589B7B7AA77CDF49433E8BC3F7E4FD291E31660A52A28E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3521009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

user32

PeekMessageA GetCursorPos wvsprintfA MessageBoxA GetSystemMetrics DefWindowProcA GetMessageA DispatchMessageA ShowCursor TranslateMessage LoadIconA LoadCursorA RegisterClassExA AdjustWindowRect GetDesktopWindow CreateWindowExA UpdateWindow SetCursor SetFocus SetForegroundWindow ShowWindow SetWindowLongA DestroyWindow BeginPaint EndPaint PostMessageA IsIconic ReleaseCapture SetCapture GetClientRect GetWindowRect SetRect UnregisterClassA SetActiveWindow GetForegroundWindow wsprintfA PostThreadMessageA PostQuitMessage

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegCreateKeyA RegCloseKey

gdi32

SetTextColor CreateCompatibleDC CreateFontA CreateBitmap SetBkMode DeleteDC ExtTextOutA SetBkColor GetPixel DeleteObject SelectObject BitBlt

shfolder

SHGetFolderPathA

shell32

ShellExecuteA

ws2_32

WSAGetLastError WSAStartup setsockopt ioctlsocket socket closesocket shutdown connect listen accept sendto send recvfrom recv select getpeername getsockname gethostbyname WSAIoctl WSACleanup bind

kernel32

VirtualQuery IsBadCodePtr GetCurrentProcessId SetEndOfFile SetStdHandle FlushFileBuffers GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA CompareStringA CompareStringW SetEnvironmentVariableA IsDebuggerPresent DebugBreak GetLocaleInfoW GetTickCount GetLocaleInfoA GetUserDefaultLCID LCMapStringW LCMapStringA SetUnhandledExceptionFilter GetCPInfo GetOEMCP GetACP HeapSize HeapReAlloc HeapCreate HeapDestroy TlsAlloc SetLastError TlsFree GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr IsBadReadPtr GetLastError QueryPerformanceFrequency QueryPerformanceCounter FindClose FindNextFileA FindFirstFileA CreateDirectoryA MultiByteToWideChar GetModuleFileNameA GetModuleHandleA GetLongPathNameA SetErrorMode CloseHandle Process32Next Process32First Sleep CreateToolhelp32Snapshot SuspendThread ResumeThread GetDriveTypeA GetLogicalDrives GetVersionExA OutputDebugStringA SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA WideCharToMultiByte GetSystemInfo IsProcessorFeaturePresent EnterCriticalSection InterlockedExchange InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection LeaveCriticalSection GetFullPathNameA MapViewOfFile GetFileSize CreateFileMappingA CreateFileA CreateFileW UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceA FindResourceW VirtualFree VirtualAlloc lstrcmpiA DuplicateHandle GetCurrentThreadId TerminateThread SleepEx GetExitCodeThread CreateEventA SetEvent WaitForSingleObject ResetEvent GetCurrentDirectoryA WriteFile SetFilePointer DeleteFileA MoveFileA ReadFile GetDiskFreeSpaceExA GlobalAlloc GlobalFree VirtualProtect CreateThread CreateMutexA ReleaseMutex HeapFree GetProcessHeap HeapAlloc WaitCommEvent GetOverlappedResult SetCommMask WaitForMultipleObjects PurgeComm SetCommState GetCommState SetCommConfig GetCommConfig SetCommTimeouts SetupComm GetCommandLineA RtlUnwind ExitProcess TerminateProcess GetTimeZoneInformation GetSystemTimeAsFileTime RaiseException ExitThread TlsSetValue TlsGetValue FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetFileType RemoveDirectoryA GetStdHandle

dsound

ord1

ddraw

DirectDrawCreate

winmm

timeSetEvent timeKillEvent timeBeginPeriod timeGetDevCaps timeGetTime timeEndPeriod

tapi32

lineAnswer lineMakeCall lineGetID lineClose lineNegotiateAPIVersion lineOpen lineGetDevCaps lineInitialize lineShutdown

netapi32

Netbios

generic

count=3, id=39, version=9162,

count=51, id=64, productName=VS2002 (.NET) build 9466, version=9466,

count=178, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=87, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=12, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=251, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=28, version=9178,

count=28, id=25, version=9210,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, id=95, version=2067,

count=6, id=18, version=8444,

count=121, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=263, id=1, productName=Unmarked objects,

count=107, id=29, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,