OpenIV[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
OpenIV.exe
Size 1.9MB
Sample260925-rd6w4atwft
SHA256 dd70067eb5f8b5f2e3d6633371a6bc7cf1a54185dd5ea50fb1f2602eee23e6e6
MD5 60f85c99f73ea2a94804810e360569ef
SHA1 9b9d253b7fe93f2fc82193de8e85efd2a7dfb03f
SHA512 8bfa2f16dd83c155dcb72f9b0e15552a87ccd4fe0a7c4e52ee098f0442def1bf9b8043d0473ced8933988ad03d5493c022b58cfe74021bae041b0a6463c4fce8
SSDEEP 49152:BEwZEC6Piqgugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Sx:BL6Xxo3
TLSH
T16395C0AD72583398C02AC9389523BD07F275781A077486DF73DABAD02F9B1D49A35B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OpenIV.exe

File Explorer

OpenIV.exe

.exe 1.9MB

OpenIV.exe

IMPHASH 5369c7b2c2b878a922f92f74cd89b5c7
SHA256 dd70067eb5f8b5f2e3d6633371a6bc7cf1a54185dd5ea50fb1f2602eee23e6e6
MD5 60f85c99f73ea2a94804810e360569ef
SHA1 9b9d253b7fe93f2fc82193de8e85efd2a7dfb03f
SHA512 8bfa2f16dd83c155dcb72f9b0e15552a87ccd4fe0a7c4e52ee098f0442def1bf9b8043d0473ced8933988ad03d5493c022b58cfe74021bae041b0a6463c4fce8
SSDEEP 49152:BEwZEC6Piqgugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Sx:BL6Xxo3
TLSH
T16395C0AD72583398C02AC9389523BD07F275781A077486DF73DABAD02F9B1D49A35B43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

485032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

AllocateAndInitializeSid SetTokenInformation SetThreadToken CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW GetTokenInformation RevertToSelf RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetEntriesInAclW PrivilegeCheck OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter AreFileApisANSI FormatMessageA GetLocaleInfoEx GetFileAttributesExW FindNextFileW FindFirstFileExW WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory FindClose GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread Module32FirstW Module32NextW ExitProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW WakeAllConditionVariable CreateProcessW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive UnhandledExceptionFilter FindFirstFileW Sleep SleepConditionVariableSRW

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW GetWindowRect SetForegroundWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture GetWindowLongW TranslateMessage SetWindowLongW SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW PeekMessageW

shell32

SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

shlwapi

PathStripPathW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset __std_exception_destroy __std_exception_copy strchr strstr memcmp memchr memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fwrite fgetpos __stdio_common_vsscanf _wfopen setvbuf ungetc __stdio_common_vfprintf fseek _set_fmode __acrt_iob_func ftell fsetpos fread __p__commode fgetc _fseeki64 fflush __stdio_common_vsprintf fclose _get_stream_buffer_pointers fputc

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcscpy_s tolower _wcsicmp towlower strcpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson terminate _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _beginthreadex _set_app_type _seh_filter_exe _cexit exit _crt_atexit _register_thread_local_exe_atexit_callback abort _wsystem _initialize_onexit_table _register_onexit_function

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sqrtf acosf __setusermatherr sqrt fmodf logf cosf ceilf pow powf sinf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale