inputlock[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inputlock.exe
Size 135KB
Sample260922-zzdfnsff33
SHA256 92f6a872afe67814f0d2cc6958c7bf8110c056033842bd81c26bc228896dbe92
MD5 3bdf73de46052c86be6e7d73ac41f954
SHA1 365777571eca187c207cecb62514e24e9ad3bf37
SHA512 da4ec58f0326aa668b59d25c4788ba1030ee4120f44591bb7b047a5238323a1cdad0f7c365f6a9c9ee174d753b33a05c40217c0e726db5e9ed9f17dd72adf8ba
SSDEEP 3072:a/BqYxF3MmGZMIflvXaGQdwMGbInRSo7dRogehBIZtye4OD:a/BqYxF3MmGeKPvQD1RS2dJebepD
TLSH
T12ED32957B3E530F8E077C67AC8914941E773B8390B619BEF07A046665E236E09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inputlock.exe

File Explorer

inputlock.exe

.exe 135KB

inputlock.exe

IMPHASH e6e830e299f098eed561cddf4d77481a
SHA256 92f6a872afe67814f0d2cc6958c7bf8110c056033842bd81c26bc228896dbe92
MD5 3bdf73de46052c86be6e7d73ac41f954
SHA1 365777571eca187c207cecb62514e24e9ad3bf37
SHA512 da4ec58f0326aa668b59d25c4788ba1030ee4120f44591bb7b047a5238323a1cdad0f7c365f6a9c9ee174d753b33a05c40217c0e726db5e9ed9f17dd72adf8ba
SSDEEP 3072:a/BqYxF3MmGZMIflvXaGQdwMGbInRSo7dRogehBIZtye4OD:a/BqYxF3MmGeKPvQD1RS2dJebepD
TLSH
T12ED32957B3E530F8E077C67AC8914941E773B8390B619BEF07A046665E236E09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CallNextHookEx SetWindowsHookExW GetClassNameW EnumWindows FillRect ShowCursor GetClientRect EndPaint BeginPaint DrawTextW GetSystemMetrics GetAsyncKeyState SetWindowPos ShowWindow DestroyWindow CreateWindowExW wsprintfW

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW

gdi32

SetTextColor CreateSolidBrush CreateFontW SelectObject SetTextAlign DeleteObject SetBkColor TextOutW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

winmm

PlaySoundW

kernel32

GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx WriteConsoleW GetEnvironmentStringsW GetStartupInfoW IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree GetCommandLineW CreateDirectoryW CreateFileW GetTempPathW CloseHandle GetLastError Sleep GetCurrentProcess CreateThread CreateProcessW VirtualAlloc SetProcessWorkingSetSize GetModuleFileNameW GetModuleHandleW CopyFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent HeapAlloc RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW

Name

.text

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

inputlock.exe

user32

advapi32

gdi32

ole32

winmm

kernel32

generic