kk4g2yegyz[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
kk4g2yegyz.exe
Size 28.5MB
Sample260922-nyrfcsde52
SHA256 7d075ecaf0015620de2db6bf4bd19de1c3cc62ceb3c8a69ef41280ad798fc9c4
MD5 936895f836b1b058d594214c66d2e3c6
SHA1 3302f540b17f6132a05cc75d6c6a08081caf95fd
SHA512 15685ea00f8811f68971f8e0e02e45ea9474ce60dfc3c983067d33135a70143c95a4b61f3b632bb6cf7cde8df58a325a4a05a90a25be2421a41b20b18c39f0f8
SSDEEP 393216:HoGqxCURHwLBhA6pXqRjWqGP2rlmTg8cJVJXe4Df2OAUs7KA0+i4ElBADQC:+HwLk8q10OrITiJnXe2fDsb0+BEkDQC
TLSH
T1256723FF64D0219CF8C68831E24566FDE487347B4EFA581B6F8616121930C9ACEE593E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kk4g2yegyz.exe

File Explorer

kk4g2yegyz.exe

.exe 28.5MB

kk4g2yegyz.exe

IMPHASH 6f731ce03141abf46cc9349e6272de22
SHA256 7d075ecaf0015620de2db6bf4bd19de1c3cc62ceb3c8a69ef41280ad798fc9c4
MD5 936895f836b1b058d594214c66d2e3c6
SHA1 3302f540b17f6132a05cc75d6c6a08081caf95fd
SHA512 15685ea00f8811f68971f8e0e02e45ea9474ce60dfc3c983067d33135a70143c95a4b61f3b632bb6cf7cde8df58a325a4a05a90a25be2421a41b20b18c39f0f8
SSDEEP 393216:HoGqxCURHwLBhA6pXqRjWqGP2rlmTg8cJVJXe4Df2OAUs7KA0+i4ElBADQC:+HwLk8q10OrITiJnXe2fDsb0+BEkDQC
TLSH
T1256723FF64D0219CF8C68831E24566FDE487347B4EFA581B6F8616121930C9ACEE593E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62104307

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RaiseException

bcrypt

BCryptGenRandom

advapi32

RegCloseKey

ntdll

NtImpersonateClientOfPort

bcryptprimitives

ProcessPrng

crypt32

CertFreeCertificateContext

oleaut32

SetErrorInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx

ws2_32

connect

user32

MonitorFromRect

dwmapi

DwmEnableBlurBehindWindow

comctl32

SetWindowSubclass

shlwapi

SHCreateMemStream

winhttp

WinHttpConnect

psapi

GetModuleInformation

gdi32

SetBkMode

api-ms-win-crt-math-l1-1-0

floor

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

17.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.5DV

Size

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.QpQ

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.k2A

Size

28.5MB

Virtual Size

28.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

kk4g2yegyz.exe

kernel32

bcrypt

advapi32

ntdll

bcryptprimitives

crypt32

oleaut32

api-ms-win-core-synch-l1-2-0

shell32

ole32

ws2_32

user32

dwmapi

comctl32

shlwapi

winhttp

psapi

gdi32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic