pastingisthekeytosuccess[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
pastingisthekeytosuccess.exe
Size 6.9MB
Sample260929-s2ryhsvbna
SHA256 017aac35fbd4fdabf1f2134a9fc6050e9871221e2b2954fc6f616d089e3145db
MD5 0ce0ae50495280b4b5a082e1b8ee15e5
SHA1 e4632d56c513749e0e0ae6c30a07f5af5e1b174f
SHA512 f12d5923ef441a5ba93280b82835dbf5fbe93890b1c92f2bb8ac29b2844a7d47181cfa35529c7b2599bfa971ea347c454a2b88cfd758a1436a914d2f1c95aa82
SSDEEP 98304:OuRW2NL7sgFsna/lgQ/6SAhL4/yED3YoUIog9BqBga:OicgFEGR/yEb2Tn
TLSH
T12876F14AB3A709ECD272E03CC5566327E372741803314BEB1BD449A59F9B6E45FB9B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pastingisthekeytosuccess.exe

File Explorer

pastingisthekeytosuccess.exe

.exe 6.9MB

pastingisthekeytosuccess.exe

IMPHASH 07a013f58b609c9be9b98fb985976e1f
SHA256 017aac35fbd4fdabf1f2134a9fc6050e9871221e2b2954fc6f616d089e3145db
MD5 0ce0ae50495280b4b5a082e1b8ee15e5
SHA1 e4632d56c513749e0e0ae6c30a07f5af5e1b174f
SHA512 f12d5923ef441a5ba93280b82835dbf5fbe93890b1c92f2bb8ac29b2844a7d47181cfa35529c7b2599bfa971ea347c454a2b88cfd758a1436a914d2f1c95aa82
SSDEEP 98304:OuRW2NL7sgFsna/lgQ/6SAhL4/yED3YoUIog9BqBga:OicgFEGR/yEb2Tn
TLSH
T12876F14AB3A709ECD272E03CC5566327E372741803314BEB1BD449A59F9B6E45FB9B02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2196032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetModuleHandleW QueryPerformanceCounter WideCharToMultiByte VerSetConditionMask FreeLibrary TerminateProcess GetCurrentProcessId GlobalLock AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW CreateDirectoryW GetCurrentDirectoryW GlobalFree SleepConditionVariableSRW DeleteCriticalSection ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetLastError WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx InitializeCriticalSectionEx CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetSystemTimeAsFileTime InitializeSListHead GlobalAlloc DeleteFileA LoadLibraryA MultiByteToWideChar GetSystemWindowsDirectoryA WaitForSingleObject GetCommandLineA GetCurrentThreadId ExitProcess GetStartupInfoA K32GetModuleBaseNameA QueryPerformanceFrequency AcquireSRWLockExclusive GetCurrentThread FindClose FindNextFileA FindFirstFileA GetModuleFileNameA InitializeCriticalSection Sleep ReadProcessMemory VirtualProtectEx CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First VirtualFreeEx LeaveCriticalSection SetThreadPriority GetCurrentProcess EnterCriticalSection GetExitCodeProcess VirtualQueryEx GlobalUnlock QueryFullProcessImageNameW GetStdHandle CreateRemoteThread VirtualAllocEx GetTickCount GetProcAddress GetModuleHandleA OutputDebugStringA GetTickCount64 GetEnvironmentVariableA GetFileInformationByHandleEx LocalFree GetLocaleInfoEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW

user32

RegisterClassExW ShowWindow GetCapture DispatchMessageW GetCursorInfo SetWindowDisplayAffinity GetMonitorInfoW ClientToScreen PeekMessageW GetWindowTextA ValidateRect GetClipCursor AttachThreadInput IsWindowEnabled UnhookWindowsHookEx EnumWindows DefWindowProcA SetLayeredWindowAttributes SetFocus GetCursor TranslateMessage FindWindowW ClipCursor GetClientRect PeekMessageA ScreenToClient UpdateLayeredWindow EmptyClipboard GetWindowLongPtrW GetMonitorInfoA SetClipboardData MsgWaitForMultipleObjects GetWindowLongPtrA GetKeyState TrackMouseEvent SetCapture UnregisterClassW SetCursorPos GetClipboardData GetLastActivePopup DefWindowProcW AllowSetForegroundWindow MonitorFromPoint DispatchMessageA GetWindowRect DrawIconEx PostQuitMessage SetWindowLongPtrA PtInRect UpdateWindow ReleaseCapture SetForegroundWindow ShowCursor InvalidateRect GetAncestor IsIconic ReleaseDC GetCursorPos BeginPaint EndPaint GetIconInfo CreateWindowExW FillRect PostMessageA CloseClipboard OpenClipboard IsWindow EnumDisplayMonitors GetWindowThreadProcessId FindWindowA SendInput GetAsyncKeyState GetForegroundWindow SetCursor LoadCursorA DestroyWindow GetDC IsWindowVisible SetWindowLongPtrW SetActiveWindow MonitorFromWindow SetWindowPos GetSystemMetrics

gdi32

CreateDIBSection CreateCompatibleDC GetStockObject SelectObject DeleteObject CreateSolidBrush GetObjectA DeleteDC

advapi32

RevertToSelf CreateProcessAsUserA RegGetValueA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx RegCloseKey RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges OpenProcessToken GetTokenInformation CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptImportKey CryptDestroyHash CryptDestroyKey CryptEncrypt

shell32

ShellExecuteA

ole32

CoInitializeEx

msvcp140

__crtLCMapStringW __crtLCMapStringA ?tolower@?$ctype@D@std@@QEBADD@Z ??7ios_base@std@@QEBA_NXZ _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Wcsxfrm _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z

ws2_32

sendto gethostname recvfrom freeaddrinfo getaddrinfo __WSAFDIsSet listen htonl accept WSAIoctl WSASetLastError setsockopt getsockname getpeername bind send recv WSACleanup closesocket select ntohl inet_addr socket ntohs connect getsockopt htons ioctlsocket WSAGetLastError WSAStartup

normaliz

IdnToAscii

crypt32

CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx

wldap32

ord200 ord301 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord30

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

dwmapi

DwmSetWindowAttribute DwmRegisterThumbnail DwmFlush DwmUpdateThumbnailProperties DwmExtendFrameIntoClientArea DwmUnregisterThumbnail DwmGetCompositionTimingInfo

winmm

timeEndPeriod timeBeginPeriod

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetOpenUrlA

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr longjmp strchr __std_type_info_compare __RTtypeid strrchr __C_specific_handler __std_terminate __std_exception_copy _CxxThrowException __std_exception_destroy __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset memmove memcpy

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh malloc free calloc

api-ms-win-crt-math-l1-1-0

atan2f ceilf sqrtf _dsign _hypotf floorf _fdclass lround sinf powf floor acosf __setusermatherr expf fmodf cosf roundf

api-ms-win-crt-string-l1-1-0

toupper isalnum isdigit _stricmp tolower isupper wcslen isalpha isxdigit iscntrl towlower _strdup strspn strcspn strpbrk strncmp strcmp strncpy isprint strlen isspace

api-ms-win-crt-stdio-l1-1-0

setvbuf _wfopen fsetpos fopen fwrite __stdio_common_vsscanf __stdio_common_vsnprintf_s fgetc fputs fseek __acrt_iob_func ftell _open fclose _close _write _read fputc ungetc feof _set_fmode __p__commode _get_stream_buffer_pointers fgetpos fgets fread __stdio_common_vsprintf _fseeki64 _lseeki64 fflush

api-ms-win-crt-convert-l1-1-0

strtoul mbstowcs strtod strtoull strtol atof atoi strtoll

api-ms-win-crt-runtime-l1-1-0

_errno __sys_nerr abort strerror _configure_narrow_argv _c_exit _beginthreadex _exit exit _initterm_e _initterm _initialize_narrow_environment terminate _get_narrow_winmain_command_line _initialize_onexit_table _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _register_onexit_function _cexit _crt_atexit _getpid

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _unlink _lock_file _stat64 _fstat64 _access

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-utility-l1-1-0

qsort