Private_External_UNIQUEID_794[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Private_External_UNIQUEID_794.exe
Size 4.2MB
Sample260922-1plvqsshqg
SHA256 2cefdcfbaa17dcf158ff4f4f9dfea9a500429afc4fdc8035247cb1f1f7d8425d
MD5 226d2f19ae088738257787f3e1f7d215
SHA1 684559a66d7655937810fe631d88db126d8e5cbe
SHA512 94bddf8ab90f04157611cd7eadf011fbf0987c7141bad4f34e76ad181724e235435f9ad7bc5f525525ae52a43f01597117ebd588a7df7c94a07026312a1b32c1
SSDEEP 49152:vY/D2E7bnv50qO7N7lhYer5QSzp8d3mK2reCq8i3yUe28qGfFlY75s5C5M0NyPZH:w/D2WFEieb012dqCkGfFlY75s5CDyR
TLSH
T184166B0D67AF469CC2A2D4B8C66A9217E2F3BC0917324FD742D04DD52E2B9D87B79E01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Private_External_UNIQUEID_794.exe

File Explorer

Private_External_UNIQUEID_794.exe

.exe 4.2MB

Private_External_UNIQUEID_794.exe

IMPHASH 2c41924838ead23dc49e34170e95db70
SHA256 2cefdcfbaa17dcf158ff4f4f9dfea9a500429afc4fdc8035247cb1f1f7d8425d
MD5 226d2f19ae088738257787f3e1f7d215
SHA1 684559a66d7655937810fe631d88db126d8e5cbe
SHA512 94bddf8ab90f04157611cd7eadf011fbf0987c7141bad4f34e76ad181724e235435f9ad7bc5f525525ae52a43f01597117ebd588a7df7c94a07026312a1b32c1
SSDEEP 49152:vY/D2E7bnv50qO7N7lhYer5QSzp8d3mK2reCq8i3yUe28qGfFlY75s5C5M0NyPZH:w/D2WFEieb012dqCkGfFlY75s5CDyR
TLSH
T184166B0D67AF469CC2A2D4B8C66A9217E2F3BC0917324FD742D04DD52E2B9D87B79E01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3672528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Downloads\axeprime\bin\Private_External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ws2_32

socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSAWaitForMultipleEvents connect closesocket WSAGetLastError bind inet_pton ntohs WSASetLastError inet_ntop WSACleanup WSAResetEvent WSAEventSelect WSAEnumNetworkEvents getpeername WSAStartup WSACreateEvent getsockname htons WSACloseEvent send recv setsockopt getsockopt

crypt32

CryptQueryObject CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertOpenStore CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptSetProperty BCryptGenRandom BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData

kernel32

GetCurrentThreadId SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetFileAttributesExA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime WriteProcessMemory ReadProcessMemory OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW WideCharToMultiByte Module32NextW VirtualQueryEx GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GetLocaleInfoEx GlobalUnlock GetProcessId K32EnumDeviceDrivers GetModuleFileNameA QueryDosDeviceW VirtualProtect SetLastError SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW GetVolumeInformationA CreateFileW Sleep GetLastError K32GetModuleBaseNameW K32GetDeviceDriverBaseNameW GetCurrentThread FreeConsole CreateThread SetFileAttributesA LocalFree ExitProcess GetCurrentProcessId CreateProcessW SetThreadExecutionState GetModuleHandleW QueryFullProcessImageNameW K32EnumProcessModules CreateDirectoryA GetTickCount GetConsoleWindow SetThreadAffinityMask SetThreadPriority CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW WakeAllConditionVariable SetFileInformationByHandle GlobalLock

user32

MapVirtualKeyW keybd_event mouse_event SendInput SendMessageW SetWindowDisplayAffinity SetWindowLongW GetWindowLongW GetWindowThreadProcessId DefWindowProcW PostMessageW DestroyWindow IsWindowVisible CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW EnumWindows SetLayeredWindowAttributes TranslateMessage FindWindowW PostQuitMessage GetParent UpdateWindow GetWindowTextW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetDC ReleaseDC FindWindowA GetAsyncKeyState

gdi32

GetPixel

advapi32

CryptCreateHash CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData GetTokenInformation RegOpenKeyExA CheckTokenMembership FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA AllocateAndInitializeSid RegQueryValueExA ConvertSidToStringSidA GetCurrentHwProfileA RegCloseKey CryptReleaseContext CryptAcquireContextW CryptGetHashParam

shell32

ShellExecuteA ShellExecuteExW

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_yield _Cnd_signal ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??Bios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_counter ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Query_perf_frequency ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z _Xtime_get_ticks ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?good@ios_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

timeBeginPeriod timeEndPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception wcschr memcmp strrchr memchr memset memmove memcpy longjmp __std_exception_copy __RTtypeid __std_type_info_compare wcsstr __C_specific_handler strchr strstr __std_terminate

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _wassert _set_app_type _configure_wide_argv _errno _crt_atexit exit __sys_errlist __sys_nerr _initialize_wide_environment system _get_wide_winmain_command_line _beginthreadex _register_thread_local_exe_atexit_callback _initterm _initterm_e abort _c_exit _exit terminate _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_wopen feof fputs fputc fflush freopen_s _popen fgets _pclose __stdio_common_vsprintf_s fgetc _wfopen _set_fmode __stdio_common_vfprintf fseek __acrt_iob_func ftell __p__commode __stdio_common_vsscanf fwrite _read _write _get_stream_buffer_pointers _fileno _close _lseeki64 _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fclose

api-ms-win-crt-heap-l1-1-0

realloc _callnewh _set_new_mode free malloc calloc

api-ms-win-crt-convert-l1-1-0

strtof strtoull wcstombs strtoll strtol strtod strtoul atoi

api-ms-win-crt-math-l1-1-0

cosf ceil asinf ceilf floorf __setusermatherr sinf sqrtf _dsign _fdopen fmodf roundf powf acosf

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink _lock_file _fstat64 remove _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func ___lc_collate_cp_func localeconv _configthreadlocale

api-ms-win-crt-string-l1-1-0

_strdup wcsncpy strpbrk wcsncmp strspn wcspbrk strcspn _wcsdup strncmp strcmp strncpy isalnum _wcsicmp _stricmp isxdigit isspace tolower strlen wcslen

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _time64 _localtime64_s _mktime64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s