CartigraphScanner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CartigraphScanner.exe
Size 3.9MB
Sample260929-tcykfaxyev
SHA256 be50cea4a8cb2e201e21a1358ef6113abaddd6512fa37df123b34f8acaa51864
MD5 cc2c7bae5ac4d111673a522a1edb0063
SHA1 99a0f1ae6c32480b271e9257d5feb7157f21abbe
SHA512 5d562402ae21cf408c9f28224a6793a88aaa42e7f84672a31aee086d09e5ced267bab9b53fa67b437fdff48f49b5f43c2ea2d9b6b9b28dedf9a1e9c729010a0d
SSDEEP 49152:/tvd/RZKPbGrCBvtyZ29lrGEm6GgQN/66Bfpn+ODVPr4rAX4+qRc2cQ8RvyxHz11:P+I16A9cDS
TLSH
T190169D13B26718EAD2F6C0398646D522D771781C83664BF726D056AABF27DE04F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CartigraphScanner.exe

File Explorer

CartigraphScanner.exe

.exe 3.9MB

CartigraphScanner.exe

IMPHASH 72708cc55b30f6841c90cb8408ba559b
SHA256 be50cea4a8cb2e201e21a1358ef6113abaddd6512fa37df123b34f8acaa51864
MD5 cc2c7bae5ac4d111673a522a1edb0063
SHA1 99a0f1ae6c32480b271e9257d5feb7157f21abbe
SHA512 5d562402ae21cf408c9f28224a6793a88aaa42e7f84672a31aee086d09e5ced267bab9b53fa67b437fdff48f49b5f43c2ea2d9b6b9b28dedf9a1e9c729010a0d
SSDEEP 49152:/tvd/RZKPbGrCBvtyZ29lrGEm6GgQN/66Bfpn+ODVPr4rAX4+qRc2cQ8RvyxHz11:P+I16A9cDS
TLSH
T190169D13B26718EAD2F6C0398646D522D771781C83664BF726D056AABF27DE04F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2541844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathW OutputDebugStringW SetUnhandledExceptionFilter QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl TryEnterCriticalSection WaitForSingleObject CreateEventW Sleep GetCurrentProcess GetCurrentThread SetThreadPriority TerminateThread ResumeThread SetPriorityClass SetFilePointer GetSystemDirectoryW GetModuleHandleW GetModuleHandleExW SetThreadAffinityMask WideCharToMultiByte GetSystemTimeAsFileTime WakeAllConditionVariable GetTickCount64 SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileAttributesExW GetFileAttributesW ReadFile InitializeSListHead FindNextFileW FindFirstFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetEnvironmentVariableW MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW EnterCriticalSection InitializeCriticalSection CloseHandle CreateFileW ExitProcess CompareStringOrdinal FormatMessageW GlobalLock GlobalUnlock GlobalSize GlobalAlloc LoadLibraryW LoadLibraryA GetProcAddress GetModuleHandleA GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentProcessId GetLastError

user32

CreateWindowExW RegisterClassExW UnregisterClassW PostMessageW IsChild UpdateLayeredWindow SetLayeredWindowAttributes GetWindowPlacement BringWindowToTop OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow DestroyIcon EnumChildWindows SetParent SetWindowLongPtrW GetWindowLongPtrW GetWindowRect InvalidateRect SetFocus SetWindowPos ShowWindow DestroyWindow DefWindowProcW GetFocus GetAsyncKeyState GetKeyboardState ToUnicode VkKeyScanW MapVirtualKeyW GetCapture SetCapture ReleaseCapture SendMessageW GetSystemMetricsForDpi GetSystemMenu EnableMenuItem GetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint GetUpdateRgn RedrawWindow SetWindowTextW GetClientRect MessageBeep SetCursorPos AttachThreadInput SendNotifyMessageW ValidateRgn ValidateRect GetAncestor GetWindowInfo EnableNonClientDpiScaling GetDpiForWindow GetAwarenessFromDpiAwarenessContext GetWindowDpiAwarenessContext GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow MonitorFromRect SystemParametersInfoW EnumDisplayDevicesW EnumDisplaySettingsW CreateIconIndirect DestroyCursor LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId EnumWindows GetParent GetDesktopWindow SetWindowLongW GetWindowLongW WindowFromPoint MapWindowPoints SetCaretPos ShowCaret DestroyCaret CreateCaret GetCursorPos TrackMouseEvent PeekMessageW GetMessagePos GetMessageTime GetMessageExtraInfo IsWindow IsWindowVisible SetCursor

gdi32

SetMapperFlags SetStretchBltMode SetBrushOrgEx CreateDIBSection StretchDIBits StretchBlt SetMapMode SelectObject SaveDC RestoreDC GetRegionData GetDeviceCaps ExcludeClipRect DeleteObject DeleteDC CreateRectRgnIndirect CreateRectRgn CreateCompatibleDC CreateBitmap CreateFontIndirectW BitBlt CombineRgn

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW DragQueryFileW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoCreateInstance CoCreateGuid

oleaut32

SysAllocString SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement SafeArrayCreateVector

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?precision@ios_base@std@@QEAA_J_J@Z ?setf@ios_base@std@@QEAAHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?classic@locale@std@@SAAEBV12@XZ _Query_perf_frequency _Query_perf_counter ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock _Cnd_signal ?_Throw_Cpp_error@std@@YAXH@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit _Cnd_broadcast _Cnd_wait _Thrd_yield ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z

winmm

midiOutGetNumDevs midiOutMessage midiInGetNumDevs midiInGetDevCapsW midiInMessage midiOutGetDevCapsW timeBeginPeriod timeGetTime

imm32

ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness GetProcessDpiAwareness GetDpiForMonitor

d2d1

ord1

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall __intrinsic_setjmp memmove memcpy __current_exception_context __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException __RTDynamicCast memset __current_exception memcmp __RTtypeid __std_type_info_compare longjmp strchr strstr __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh calloc realloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode fflush fwrite __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fread __acrt_iob_func

api-ms-win-crt-string-l1-1-0

strcmp towupper iswspace strcpy iswdigit iswalpha iswalnum strncpy strncmp strlen towlower

api-ms-win-crt-math-l1-1-0

__setusermatherr atan2f atanf _dclass _fdclass ceilf exp floorf sin expf _hypot _hypotf ceil floor sqrtf acos cos cosf fmod sinf tanf pow truncf sqrt

api-ms-win-crt-runtime-l1-1-0

exit _configure_narrow_argv _cexit _initterm _fpreset _register_onexit_function _endthreadex _initialize_narrow_environment _errno _beginthreadex _initialize_onexit_table _seh_filter_exe _set_app_type _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _initterm_e terminate _exit _c_exit __p___argc __p___argv _crt_atexit

api-ms-win-crt-convert-l1-1-0

atoi mbstowcs _strtod_l _atoi64 strtod

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_ftime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _create_locale

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CartigraphScanner.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcp140

winmm

imm32

dwmapi

api-ms-win-shcore-scaling-l1-1-1

d2d1

dxgi

d3d11

dcomp

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic