CorkDork[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CorkDork.exe
Size 4.5MB
Sample260925-v645rasdph
SHA256 87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d
MD5 d622d8c02e4da46bbb6e4c3c6b413b02
SHA1 28501cb09a00ed905b572b733b832ef7632faf62
SHA512 b46a5f9ba5f772bbcd6dc635016c550cb43eb4d86c706f226d2c03579fecc732cf52d8af795e888f954cb982b2c6ed070007894f13c63e8ec2caccbfe4eab33e
SSDEEP 49152:wa1CZHN6Js6n0ejMhChyMaNzynymvbb2zGNCE/q4TEJTgoIB8Zw+AHw2Mmq9SASt:GMn/jkkym2gHB+0w2Md9SVN55
TLSH
T11E265B557A4A586DC04AC47082478A335A3138DB1B36BAFF41C4A6353FB9BF06F3D668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CorkDork.exe

File Explorer

CorkDork.exe

.exe 4.5MB

CorkDork.exe

IMPHASH 5eb27d29354a87f9a79ac880dc335c5d
SHA256 87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d
MD5 d622d8c02e4da46bbb6e4c3c6b413b02
SHA1 28501cb09a00ed905b572b733b832ef7632faf62
SHA512 b46a5f9ba5f772bbcd6dc635016c550cb43eb4d86c706f226d2c03579fecc732cf52d8af795e888f954cb982b2c6ed070007894f13c63e8ec2caccbfe4eab33e
SSDEEP 49152:wa1CZHN6Js6n0ejMhChyMaNzynymvbb2zGNCE/q4TEJTgoIB8Zw+AHw2Mmq9SASt:GMn/jkkym2gHB+0w2Md9SVN55
TLSH
T11E265B557A4A586DC04AC47082478A335A3138DB1B36BAFF41C4A6353FB9BF06F3D668
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2500972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ottod\Desktop\build\corkDork\target\release\deps\cork_dork.pdb

kernel32

GetCurrentThreadId InitializeSListHead RtlVirtualUnwind TryAcquireSRWLockExclusive CreateFileW FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleMode SetConsoleCursorPosition GetFileInformationByHandleEx QueryPerformanceFrequency QueryPerformanceCounter PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetModuleHandleA GetStdHandle SetThreadStackGuarantee AddVectoredExceptionHandler HeapReAlloc GetSystemInfo SetFilePointerEx SetConsoleTitleW SetLastError GetConsoleScreenBufferInfo lstrlenW GetFinalPathNameByHandleW WaitForSingleObject MultiByteToWideChar WriteConsoleW WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA GetCurrentProcess ReleaseMutex GetEnvironmentVariableW RtlLookupFunctionEntry GetModuleHandleW FormatMessageW GetFileInformationByHandle GetConsoleMode GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose ReadConsoleW WideCharToMultiByte SwitchToThread ReleaseSRWLockExclusive CreateIoCompletionPort SetFileCompletionNotificationModes CreateThread GetSystemTimeAsFileTime GetCurrentDirectoryW RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared SetHandleInformation AcquireSRWLockExclusive CloseHandle GetLastError GlobalMemoryStatusEx Sleep IsDebuggerPresent GetProcAddress GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc GetProcessHeap HeapFree IsProcessorFeaturePresent

pdh

PdhCollectQueryData PdhAddEnglishCounterA PdhGetFormattedCounterArrayA PdhOpenQueryA PdhCloseQuery

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertDuplicateStore CertFreeCertificateChain CertGetCertificateChain

bcrypt

BCryptGenRandom

ws2_32

connect getsockopt WSAIoctl WSASocketW socket bind getaddrinfo setsockopt closesocket freeaddrinfo WSAStartup WSACleanup recv getsockname WSAGetLastError getpeername send WSASend ioctlsocket shutdown

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtReadFile NtCreateFile RtlNtStatusToDosError

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

advapi32

SystemFunction036 RegOpenKeyExW RegCloseKey RegQueryValueExW

secur32

AcquireCredentialsHandleA DeleteSecurityContext FreeCredentialsHandle FreeContextBuffer EncryptMessage DecryptMessage QueryContextAttributesW InitializeSecurityContextW AcceptSecurityContext ApplyControlToken

vcruntime140

memcpy __current_exception_context __CxxFrameHandler3 memset memmove memcmp _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit _configure_narrow_argv terminate _initialize_onexit_table _register_onexit_function exit _initterm_e _initterm _set_app_type _seh_filter_exe _get_initial_narrow_environment _crt_atexit __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

CorkDork.exe

kernel32

pdh

crypt32

bcrypt

ws2_32

ntdll

shell32

ole32

advapi32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic