XP_afeaf6d0[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XP_afeaf6d0.exe
Size 760KB
Sample260929-1zq77sysfs
SHA256 db000a7d65b62809ce631e20befb41f66bd8db024296cd461210be21bc37e3ca
MD5 5bfd43d27369255a35bf376526abf51b
SHA1 bef85e71e55c40876e4bf09b56a4692888321012
SHA512 3b5c96b8768e1b16cfddd75ab28685e5298cbce0d256b875b5187ef2b1344cf8b770cf43a69bbd8991942fe7402ab974894d0867a2f2dcc92c7518757cc1fd96
SSDEEP 6144:Gcr7ACi49qtHT6WmoJFMp3JVUaGLKPoX+IcHe3yvXvisJkcVPolbYD1q+Dc0Gtk9:GcoJddOWLrLKP9LKKYoyFeVONNhTLq
TLSH
T123F44B16B7A49EEADC12623895CF631DA735FCA007939BC7671012216E47BE88D7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XP_afeaf6d0.exe

File Explorer

XP_afeaf6d0.exe

.exe 760KB

XP_afeaf6d0.exe

IMPHASH 66325bb432cb1b3b6f170f3809f220f7
SHA256 db000a7d65b62809ce631e20befb41f66bd8db024296cd461210be21bc37e3ca
MD5 5bfd43d27369255a35bf376526abf51b
SHA1 bef85e71e55c40876e4bf09b56a4692888321012
SHA512 3b5c96b8768e1b16cfddd75ab28685e5298cbce0d256b875b5187ef2b1344cf8b770cf43a69bbd8991942fe7402ab974894d0867a2f2dcc92c7518757cc1fd96
SSDEEP 6144:Gcr7ACi49qtHT6WmoJFMp3JVUaGLKPoX+IcHe3yvXvisJkcVPolbYD1q+Dc0Gtk9:GcoJddOWLrLKP9LKKYoyFeVONNhTLq
TLSH
T123F44B16B7A49EEADC12623895CF631DA735FCA007939BC7671012216E47BE88D7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

dasdas3

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup closesocket connect gethostbyname htons recv send setsockopt socket

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

advapi32

CloseServiceHandle EnumServicesStatusA GetUserNameA OpenSCManagerA RegCloseKey RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

user32

GetDC GetSystemMetrics MessageBoxA ReleaseDC ShowWindow

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fileno _setmode fflush fputc fputwc setvbuf

api-ms-win-crt-string-l1-1-0

_stricmp _strlwr _wcsicmp memset strcmp strlen strncat strncmp strncpy strnlen towlower wcslen wcsnlen

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror system

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc strtof strtol strtoll strtoul strtoull wcrtomb wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strstr wcsstr

shell32

SHGetFolderPathA

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileA CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FlsAlloc FlsGetValue FlsSetValue GetComputerNameA GetConsoleWindow GetCurrentProcess GetCurrentThreadId GetDiskFreeSpaceExA GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesA SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualAllocEx VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XP_afeaf6d0.exe

ws2_32

bcrypt

advapi32

user32

gdi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

shell32

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic