release (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
release (1).exe
Size 3.6MB
Sample260924-aa7ksaxt2n
SHA256 3719d2ab462b8e67966de57b887e46a108ed1dc6cdb5dba6dc46a9fcf1320a01
MD5 593c87115630a96a44e1a34a8fb0b702
SHA1 4688c88fb5b58e65029a0e58fc6e27c02ce2e0f7
SHA512 6794e58a6128d3344958c9ba59467195de80ee12d2106b7967b0a57a7afe82b714dad89f3c0da0c76f3831e16b37d48c2aa5cafd02282cea2fe35987dc960f2b
SSDEEP 98304:njjD82ZSio/Y7mgTm05AwJHE6heTlZqL9PlF:njj42kg7PAmklZqL1lF
TLSH
T1E7069D06F392C299C2659938CD52E7A7D3317C084F2242E776D8BE1B7EB26E04E79741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
release (1).exe

File Explorer

release (1).exe

.exe 3.6MB

release (1).exe

IMPHASH e97ad6b1aef77c21d1773d4786aa74c3
SHA256 3719d2ab462b8e67966de57b887e46a108ed1dc6cdb5dba6dc46a9fcf1320a01
MD5 593c87115630a96a44e1a34a8fb0b702
SHA1 4688c88fb5b58e65029a0e58fc6e27c02ce2e0f7
SHA512 6794e58a6128d3344958c9ba59467195de80ee12d2106b7967b0a57a7afe82b714dad89f3c0da0c76f3831e16b37d48c2aa5cafd02282cea2fe35987dc960f2b
SSDEEP 98304:njjD82ZSio/Y7mgTm05AwJHE6heTlZqL9PlF:njj42kg7PAmklZqL1lF
TLSH
T1E7069D06F392C299C2659938CD52E7A7D3317C084F2242E776D8BE1B7EB26E04E79741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

asd

Minor OS version

Major OS version

Entry point

1008320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

timeBeginPeriod PlaySoundA

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpOpen WinHttpCloseHandle WinHttpWriteData WinHttpCrackUrl WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect

crypt32

CryptProtectData CryptUnprotectData

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptHashData BCryptCreateHash BCryptDestroyHash

kernel32

ReleaseSRWLockExclusive InitOnceBeginInitialize GetCurrentThreadId WakeAllConditionVariable InitOnceComplete GetFileInformationByHandleEx GetModuleHandleW GetModuleFileNameA GetCurrentProcess GetModuleHandleA CloseHandle SetFileAttributesA GetProcAddress LocalFree IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError FormatMessageA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter Sleep CreateThread GetTickCount RtlCaptureContext GetStdHandle SetConsoleMode AcquireSRWLockExclusive GetSystemInfo VirtualProtectEx FlushInstructionCache VirtualQueryEx SetThreadPriority GetCurrentThread ReadProcessMemory Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next VirtualAllocEx VirtualFreeEx GetFileAttributesW SetFileAttributesW GetWindowsDirectoryA ExitProcess SwitchToThread RtlLookupFunctionEntry AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockShared AcquireSRWLockShared GetConsoleMode RtlVirtualUnwind UnhandledExceptionFilter SleepConditionVariableSRW SetUnhandledExceptionFilter TerminateProcess SetLastError IsProcessorFeaturePresent

user32

MonitorFromPoint DispatchMessageA GetWindowRect GetClipboardData GetSystemMetrics ShowWindow SetWindowDisplayAffinity MessageBoxA DefWindowProcA DestroyWindow SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow SetWindowPos SetWindowLongPtrA GetWindowThreadProcessId IsWindow EnumWindows GetAsyncKeyState CreateWindowExA FindWindowA SendInput GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout SetClipboardData

gdi32

GetDeviceCaps

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

shell32

SHGetSpecialFolderPathA ShellExecuteW

msvcp140

_Thrd_id _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Thrd_join ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?_Random_device@std@@YAIXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Cnd_unregister_at_thread_exit _Cnd_broadcast ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset memcpy memchr strchr __std_terminate __std_exception_copy __std_exception_destroy memcmp _CxxThrowException memmove

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsprintf ftell fseek _get_stream_buffer_pointers _fseeki64 fputc __acrt_iob_func __stdio_common_vfprintf _set_fmode __p__commode __stdio_common_vsscanf _wfopen fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _seh_filter_exe _set_app_type _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _initialize_narrow_environment _get_initial_narrow_environment _initterm __p___argc _initterm_e exit abort _invoke_watson _exit _beginthreadex terminate _errno

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

powf __setusermatherr atan2f floorf cosf _dsign ceilf ldexp roundf _dclass _fdclass sinf fmodf asinf sqrtf acosf

api-ms-win-crt-convert-l1-1-0

strtol atof strtoull strtoll strtod

api-ms-win-crt-string-l1-1-0

strncpy_s strncmp strncpy isalnum _stricmp tolower isspace strcmp

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64