inputlock[.]exe | Triage™

General

Target
inputlock.exe
Size 101KB
Sample260922-zees1afa56
SHA256 72b42eeab17e5e43a49e1bf8cdca56f6de4c281f48bd68b47d466ee92bcba7a3
MD5 e15746c32fecc0e8b624ce9bbe1fd7a5
SHA1 15cf788d02fcd04f430dd88f12f0b9218ed068d8
SHA512 3c0fa41a4177f276014572ad6f1f5516157a2d3b244bbf8e27de97ee45c32d27eee8587916029871c767d2833b0b5182f0f4a3cc00b40de563ee3a472af5483d
SSDEEP 1536:O6LMtfXDBn9uEkjp8x70AWzTH4SSkYg0C2QMHKa6yzwKNsW3tFsZdm9dlFNTP++w:xLkbqE0AKYhkf0pQSBzRtezetP++++h
TLSH
T1C9A3495B73E530F8E5BA8278C8514A59E776B87117609BEF07B4029A1F232D08D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inputlock.exe

File Explorer

inputlock.exe

.exe 101KB

inputlock.exe

IMPHASH d33ea44e49afeddeaee92fcd6407cf27
SHA256 72b42eeab17e5e43a49e1bf8cdca56f6de4c281f48bd68b47d466ee92bcba7a3
MD5 e15746c32fecc0e8b624ce9bbe1fd7a5
SHA1 15cf788d02fcd04f430dd88f12f0b9218ed068d8
SHA512 3c0fa41a4177f276014572ad6f1f5516157a2d3b244bbf8e27de97ee45c32d27eee8587916029871c767d2833b0b5182f0f4a3cc00b40de563ee3a472af5483d
SSDEEP 1536:O6LMtfXDBn9uEkjp8x70AWzTH4SSkYg0C2QMHKa6yzwKNsW3tFsZdm9dlFNTP++w:xLkbqE0AKYhkf0pQSBzRtezetP++++h
TLSH
T1C9A3495B73E530F8E5BA8278C8514A59E776B87117609BEF07B4029A1F232D08D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage GetMessageW

kernel32

HeapAlloc WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

inputlock.exe

user32

kernel32

generic