Koid[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Koid.exe
Size 1.5MB
Sample260929-plerga1z2p
SHA256 4bf92841621b08ec1796fa380fd71bd9f6fec65b923aec1dbd5b074f062eaf21
MD5 15ec276e3c1d3d757eed8698c59c1095
SHA1 28be0d3db48ef6423c2c4e222f5f949b8ed6e845
SHA512 467196ee35523d4a24bd3746a9785040e092e4aba096c4e342ce1dfe2a9c3b1ca61f207b4581ac97a3861f12f714581854339727681aba1ba93d8e36ef9eb671
SSDEEP 24576:u06LkHhLdZYQVoNVePYOEOKTyBHJsXoAFWlT4Adw/u1/XFlwTUOcA5qmr37Pn6:unkHhLdpPYO1M+Brgdhwmzrn6
TLSH
T1BD75F1C6E392097DCFAAB03890996757DA753C48077286DB33DC44612F563F89ABE360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Koid.exe

File Explorer

Koid.exe

.exe 1.5MB

Koid.exe

IMPHASH 3fd06be36c16623831cd45fd8968adcb
SHA256 4bf92841621b08ec1796fa380fd71bd9f6fec65b923aec1dbd5b074f062eaf21
MD5 15ec276e3c1d3d757eed8698c59c1095
SHA1 28be0d3db48ef6423c2c4e222f5f949b8ed6e845
SHA512 467196ee35523d4a24bd3746a9785040e092e4aba096c4e342ce1dfe2a9c3b1ca61f207b4581ac97a3861f12f714581854339727681aba1ba93d8e36ef9eb671
SSDEEP 24576:u06LkHhLdZYQVoNVePYOEOKTyBHJsXoAFWlT4Adw/u1/XFlwTUOcA5qmr37Pn6:unkHhLdpPYO1M+Brgdhwmzrn6
TLSH
T1BD75F1C6E392097DCFAAB03890996757DA753C48077286DB33DC44612F563F89ABE360
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

334408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Diego\Documents\source\aaaaaaa\koid\x64\Release\koid.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

kernel32

QueryPerformanceCounter GetModuleHandleA GetConsoleWindow CreateThread Process32First GetCurrentProcess OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle WriteProcessMemory ReadProcessMemory GetModuleFileNameA GlobalLock GetCurrentProcessId VirtualQueryEx GetExitCodeProcess GlobalFree QueryPerformanceFrequency GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GlobalAlloc MultiByteToWideChar GetProcAddress LoadLibraryA GlobalUnlock GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte TerminateProcess

user32

GetWindowTextA GetCursorInfo SetCursor PostMessageA SendMessageA keybd_event SetForegroundWindow GetWindowThreadProcessId FindWindowA WindowFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowPos ShowWindow GetAsyncKeyState SetWindowLongA DefWindowProcA CreateWindowExA TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage GetDesktopWindow RegisterClassExA UpdateWindow GetKeyState LoadCursorA SetCapture ScreenToClient GetCapture ClientToScreen GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetForegroundWindow IsChild

advapi32

OpenProcessToken OpenServiceA AdjustTokenPrivileges CloseServiceHandle QueryServiceStatusEx OpenSCManagerA LookupPrivilegeValueA

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_sleep _Query_perf_counter _Xtime_get_ticks ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Random_device@std@@YAIXZ _To_wide _Close_dir _Open_dir _Read_dir ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

xinput1_4

ord2 ord4

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp memchr _CxxThrowException memset __C_specific_handler __current_exception_context __current_exception __std_type_info_compare __std_exception_copy __std_exception_destroy strstr __std_terminate memmove

api-ms-win-crt-stdio-l1-1-0

ungetc fgetc __stdio_common_vsscanf fread fputc fclose __stdio_common_vsprintf _wfopen fwrite fsetpos _fseeki64 fseek setvbuf fflush __p__commode __acrt_iob_func fgetpos ftell _get_stream_buffer_pointers _set_fmode

api-ms-win-crt-string-l1-1-0

toupper strncpy isprint strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-runtime-l1-1-0

_exit _get_initial_narrow_environment __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table _initterm _initialize_narrow_environment _configure_narrow_argv terminate exit _initterm_e _invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

atan2f ceil ceilf pow powf sinf sqrtf cosf floorf fmodf __setusermatherr acosf log2

api-ms-win-crt-filesystem-l1-1-0

remove _unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale