pinetree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pinetree.exe
Size 9.3MB
Sample260925-252rkazs9q
SHA256 9d5f7867c4168a94f3307504cb5b1982773de8e54239643cbbb7a0c34a4f8e4c
MD5 01cf16833647759b9f1573e929911a8a
SHA1 2e6031f5e3ce363514cf87ea7f73a97a25678376
SHA512 e902348fea966c39d7fe45faf62f972488f3ca133b019c31bf70f77bfe57495617775ea21cecc45624baca3b0e70b80318f180e196471e2b2313e54ada2bfb75
SSDEEP 98304:dn6JqOtawwZeHV4J18VHHx4IR/uxHLJB+hSGym6EMAN+Mb7eChOq3bwv8:5sqbwwZW25JIhSGym6EMAIMb7jUv8
TLSH
T120A6B003F74AE95DE017C87443028273A951B85B1B36E6FB49DA65353D6FBE00F287A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pinetree.exe

File Explorer

pinetree.exe

.exe 9.3MB

pinetree.exe

IMPHASH 84706843c834004670016f34fdc2fee6
SHA256 9d5f7867c4168a94f3307504cb5b1982773de8e54239643cbbb7a0c34a4f8e4c
MD5 01cf16833647759b9f1573e929911a8a
SHA1 2e6031f5e3ce363514cf87ea7f73a97a25678376
SHA512 e902348fea966c39d7fe45faf62f972488f3ca133b019c31bf70f77bfe57495617775ea21cecc45624baca3b0e70b80318f180e196471e2b2313e54ada2bfb75
SSDEEP 98304:dn6JqOtawwZeHV4J18VHHx4IR/uxHLJB+hSGym6EMAN+Mb7eChOq3bwv8:5sqbwwZW25JIhSGym6EMAIMb7jUv8
TLSH
T120A6B003F74AE95DE017C87443028273A951B85B1B36E6FB49DA65353D6FBE00F287A8
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3349892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pinetree.pdb

user32

GetMenu GetWindowLongW EnableMenuItem GetSystemMenu SetWindowLongW ShowWindow SetWindowDisplayAffinity MonitorFromWindow GetMonitorInfoW GetCursorPos MapVirtualKeyW ReleaseCapture SetCapture RegisterWindowMessageA MsgWaitForMultipleObjectsEx SystemParametersInfoA RegisterRawInputDevices MonitorFromPoint EmptyClipboard EnumDisplayMonitors GetClipCursor ClipCursor GetClipboardData IsClipboardFormatAvailable ShowCursor DestroyIcon DestroyCursor GetWindowRect IsIconic IsProcessDPIAware GetRawInputData SendInput SetForegroundWindow SetWindowTextW OpenClipboard AdjustWindowRectEx SetClipboardData GetWindowTextLengthW GetWindowTextW SetWindowPlacement ChangeDisplaySettingsExW SetCursor LoadCursorW RegisterTouchWindow RemovePropW FlashWindowEx SetCursorPos ClientToScreen InvalidateRgn GetForegroundWindow SetWindowLongPtrW SetPropW CreateIcon CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetClassNameW GetWindowPlacement CallWindowProcW GetPropW GetDC GetClientRect RedrawWindow GetWindowLongPtrW CreateIconFromResourceEx SendMessageW GetSystemMetrics GetActiveWindow ReleaseDC DispatchMessageW TranslateMessage PeekMessageW PostMessageW DestroyWindow RegisterClipboardFormatW ValidateRect CloseClipboard ScreenToClient MonitorFromRect TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle GetKeyboardLayout MapVirtualKeyExW GetKeyState ToUnicodeEx GetKeyboardState GetAsyncKeyState SetWindowPos

kernel32

HeapAlloc SetEvent LoadLibraryExA CreateEventA GetCurrentThreadId SetThreadPriority WaitForMultipleObjectsEx GetLastError GetProcAddress LoadLibraryW LoadLibraryExW FreeLibrary GetModuleFileNameW SetThreadErrorMode InitializeSListHead HeapFree GetProcessHeap CreateMutexA WaitForSingleObjectEx WriteConsoleW GetConsoleOutputCP GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GlobalLock GlobalSize GlobalAlloc GetConsoleMode CreateWaitableTimerExW SetWaitableTimer CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CreateFileW FindNextFileW GetFullPathNameW CreateThread ReadFileEx GetEnvironmentVariableW ExitProcess GetModuleHandleW GetEnvironmentStringsW LoadLibraryA ReleaseMutex HeapReAlloc lstrlenW CloseHandle WaitForSingleObject GlobalUnlock IsProcessorFeaturePresent CopyFileExW FindClose FindFirstFileExW GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetExitCodeProcess SleepEx WriteFileEx GlobalFree WideCharToMultiByte GetCurrentProcessId GetStdHandle MultiByteToWideChar SetUnhandledExceptionFilter GetCurrentThread FormatMessageW GetSystemTimeAsFileTime GetCurrentDirectoryW SetLastError SetFilePointerEx DuplicateHandle GetCurrentProcess SetFileInformationByHandle Sleep GetModuleHandleA UnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

shell32

SHGetKnownFolderPath DragQueryFileW DragFinish

combase

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

opengl32

wglShareLists wglGetProcAddress wglMakeCurrent wglGetCurrentContext wglGetCurrentDC wglCreateContext wglDeleteContext

ole32

CoCreateInstance RevokeDragDrop RegisterDragDrop OleInitialize CoUninitialize CoInitializeEx

gdi32

SetPixelFormat SwapBuffers DeleteObject ChoosePixelFormat CreateRectRgn GetDeviceCaps DescribePixelFormat

shlwapi

AssocQueryStringW

advapi32

RevertToSelf ImpersonateAnonymousToken

uiautomationcore

UiaLookupId UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue

oleaut32

SafeArrayPutElement SysFreeString SafeArrayCreateVector SetErrorInfo SysAllocStringLen SysStringLen VariantClear GetErrorInfo

imm32

ImmSetCompositionWindow ImmGetCompositionStringW ImmGetContext ImmAssociateContextEx ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

ntdll

NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtReadFile

vcruntime140

__C_specific_handler memset _CxxThrowException __CxxFrameHandler3 memcpy memmove __current_exception memcmp __current_exception_context

api-ms-win-crt-math-l1-1-0

exp2f ceil round cbrtf acosf log10 sin cos trunc truncf pow exp2 powf atanf ldexp __setusermatherr atan2f floor sinf cosf ceilf roundf floorf expf fmod _hypotf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initialize_narrow_environment _initterm _register_onexit_function strerror _configure_narrow_argv _seh_filter_exe exit _exit terminate _crt_atexit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _set_app_type _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode