x-cool[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
x-cool.exe
Size 1.4MB
Sample260925-2lm43aybph
SHA256 db24d7ceacd1818bb8e81e89384cf5dc9c04ef33d217732fee4d93ce52a4dcf7
MD5 3ac8cfed38baf16407c89ca0833fae88
SHA1 761ae33e614f5df2ad3cf4c0308c98db69214323
SHA512 e967d6c098556793df29d638a6862dd387d57c78dc7821cf79770cf86a0667e7a7a23b651b0c1aaa9c961a2612f7913faae6c8bf6a5d2f339ada25bec03e01e0
SSDEEP 24576:oc8IX34AZxYjJaFhr5qDHfjoJnU/35AP076JIqMla8HRIB4/Wo:p8IX3ujJaFhr5qDHfjXAo6JBX0
TLSH
T1D7656D2A691C009CF177C1BCC6DB9C07E676780903359EEF06D15AAA1A1BEDC477EE21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x-cool.exe

File Explorer

x-cool.exe

.exe 1.4MB

x-cool.exe

IMPHASH 0933db7004cee14bbea5bab198fbcb11
SHA256 db24d7ceacd1818bb8e81e89384cf5dc9c04ef33d217732fee4d93ce52a4dcf7
MD5 3ac8cfed38baf16407c89ca0833fae88
SHA1 761ae33e614f5df2ad3cf4c0308c98db69214323
SHA512 e967d6c098556793df29d638a6862dd387d57c78dc7821cf79770cf86a0667e7a7a23b651b0c1aaa9c961a2612f7913faae6c8bf6a5d2f339ada25bec03e01e0
SSDEEP 24576:oc8IX34AZxYjJaFhr5qDHfjoJnU/35AP076JIqMla8HRIB4/Wo:p8IX3ujJaFhr5qDHfjXAo6JBX0
TLSH
T1D7656D2A691C009CF177C1BCC6DB9C07E676780903359EEF06D15AAA1A1BEDC477EE21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

684032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\emulator\build\x-cool.pdb

kernel32

SetConsoleWindowInfo SetSystemTime SetFilePointer CreateMutexW GetEnvironmentVariableA FindClose CreateMutexA WaitForSingleObject CreateFileW UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetConsoleMode GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA FileTimeToSystemTime LoadLibraryA QueryPerformanceFrequency Process32FirstW CloseHandle GetLocalTime FillConsoleOutputAttribute Beep GetProcAddress SetFilePointerEx CreateFileMappingA LocalFree GetCurrentProcessId GetNumberOfConsoleInputEvents FreeLibrary GetConsoleWindow CreateProcessA SetConsoleOutputCP GetSystemTimeAsFileTime CreateNamedPipeW SetConsoleCursorPosition MapViewOfFile QueryPerformanceCounter GetTickCount ConnectNamedPipe SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess GetLocaleInfoEx InitializeSListHead GetCurrentThreadId GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WideCharToMultiByte GetModuleFileNameW TerminateProcess DeviceIoControl OutputDebugStringA SetCurrentConsoleFontEx SetConsoleMode WriteFile CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW GetModuleHandleW AreFileApisANSI CreateFile2 GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW GetStdHandle SetConsoleScreenBufferSize GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute GetConsoleScreenBufferInfo GetFileSizeEx FindFirstFileW SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA GetSystemTime ReadFile SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW FormatMessageA

user32

GetAsyncKeyState GetSystemMetrics MessageBoxW SetWindowLongW ShowScrollBar GetWindowLongW MessageBoxA SetLayeredWindowAttributes SetWindowPos

advapi32

CheckTokenMembership OpenProcessToken AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW FreeSid

shell32

ShellExecuteA

bcrypt

BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptGenRandom BCryptExportKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptFinalizeKeyPair

crypt32

CryptStringToBinaryA CertFreeCertificateContext PFXExportCertStore CryptDecodeObjectEx PFXImportCertStore CryptBinaryToStringA CertCloseStore CertStrToNameA CryptImportPublicKeyInfoEx2 CertFindCertificateInStore CertCreateSelfSignCertificate CertOpenStore

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7facet@locale@std@@6B@ ??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?rdstate@ios_base@std@@QEBAHXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0_Facet_base@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z __crtLCMapStringA __crtLCMapStringW _Query_perf_frequency _Strxfrm ??_7_Facet_base@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??0_Lockit@std@@QEAA@H@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

wininet

HttpQueryInfoA HttpAddRequestHeadersA HttpOpenRequestA InternetQueryOptionA InternetReadFile InternetConnectA InternetSetOptionA HttpSendRequestA InternetCloseHandle InternetOpenA

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData

ws2_32

htonl WSAStartup send closesocket WSAGetLastError socket setsockopt connect htons accept recv bind listen

secur32

EncryptMessage DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext FreeContextBuffer

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_type_info_destroy_list __std_exception_destroy __C_specific_handler __current_exception_context __current_exception memset memmove memchr memcpy memcmp __std_terminate wcsrchr __RTtypeid strchr __std_type_info_compare __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

fgets fwrite __stdio_common_vsprintf fseek _set_fmode fopen ftell fgetpos __stdio_common_vfprintf ungetc fgetc __p__commode __stdio_common_vsprintf_s fsetpos fputc fread fclose setvbuf _wfopen_s _get_stream_buffer_pointers _fseeki64 fflush _fsopen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh realloc calloc

api-ms-win-crt-string-l1-1-0

isdigit wcslen isalnum strlen _wcsicmp isxdigit wcscpy_s wcscat_s strcpy_s _stricmp tolower

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _exit exit _initterm_e _initterm _c_exit _register_thread_local_exe_atexit_callback abort system _errno _beginthreadex _get_initial_narrow_environment _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit terminate _cexit _seh_filter_exe _set_app_type _crt_at_quick_exit

api-ms-win-crt-convert-l1-1-0

atoi strtoull

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr