skeet[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
skeet.exe
Size 5.9MB
Sample260925-wt52ysty6l
SHA256 e635f38c79415ed392df48ac10bc1c8607a8ea0cfa2e255083c72824688aefc6
MD5 77f7d3225e2af535e0b810c61e9cfa45
SHA1 ed461a7bc0e3800fb0c5c355d8618a73ef65d7a1
SHA512 ab87b928e85f142041da840569f0037e4641354b135bf62644dba45c09644c378cd7ac294782abf1a29a74e2b0c2b5ef39ce6e1b8ff4ff883182baeb65b0abca
SSDEEP 49152:UXXHdmeeLugRlxmCknXq8UD0A/3rlkGxpo+8VtoPH14/KrOAr/k8ewVH3nXH3nXJ:tTmCka8UD0A80O5RVXXhuBX/x83j/s
TLSH
T1E556BF03F78551EDD02BD57886A7A327E272B8490B3157DB13846A386E937D01F3AB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
skeet.exe

File Explorer

skeet.exe

.exe 5.9MB

skeet.exe

IMPHASH d471bb20c51d36ef6fabe3f9f5819b02
SHA256 e635f38c79415ed392df48ac10bc1c8607a8ea0cfa2e255083c72824688aefc6
MD5 77f7d3225e2af535e0b810c61e9cfa45
SHA1 ed461a7bc0e3800fb0c5c355d8618a73ef65d7a1
SHA512 ab87b928e85f142041da840569f0037e4641354b135bf62644dba45c09644c378cd7ac294782abf1a29a74e2b0c2b5ef39ce6e1b8ff4ff883182baeb65b0abca
SSDEEP 49152:UXXHdmeeLugRlxmCknXq8UD0A/3rlkGxpo+8VtoPH14/KrOAr/k8ewVH3nXH3nXJ:tTmCka8UD0A80O5RVXXhuBX/x83j/s
TLSH
T1E556BF03F78551EDD02BD57886A7A327E272B8490B3157DB13846A386E937D01F3AB93
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

863792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\skeet\loader\..\bin\Ship\skeet.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CloseThreadpoolTimer CloseThreadpoolWait CompareStringOrdinal CompareStringW CreateDirectoryW CreateEventExW CreateFileMappingW CreateFileW CreateRemoteThread CreateSemaphoreExW CreateSymbolicLinkW CreateThread CreateThreadpoolTimer CreateThreadpoolWait CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushProcessWriteBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetExitCodeThread GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetTimeFormatW GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale IsWow64Process2 LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadpoolTimer SetThreadpoolWait SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAllocEx VirtualFreeEx VirtualProtect WaitForMultipleObjects WaitForSingleObjectEx WaitForThreadpoolTimerCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

AdjustWindowRectEx BringWindowToTop ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard EnumDisplayMonitors EnumWindows GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetMonitorInfoA GetWindowLongW GetWindowTextW GetWindowThreadProcessId IsChild IsIconic IsWindowVisible LoadCursorA MonitorFromWindow OpenClipboard PeekMessageA RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetProcessDPIAware SetWindowLongA SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UnregisterClassA UpdateWindow WindowFromPoint

d3d9

Direct3DCreate9

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize StringFromGUID2

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteW

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

280KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

453KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

Name

.rsrc

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

skeet.exe

kernel32

user32

d3d9

ole32

advapi32

shell32

gdi32

dwmapi

imm32

generic