tigue[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tigue.zip
Size 153KB
Sample260930-gvdlrsshle
SHA256 ae921064d3ae3bf9b21a5c3c93160acc5fc1c88517927919b519b675d896672f
MD5 211285abd1cdf335b324ae801808001a
SHA1 dbfc4a6c23ad37e3f311a490d0d78045f0354524
SHA512 b87e526614bbe033fe48aaa22f707a9ee7f277c24e8734975c7258a9bbcb629d02d7bfc7a3e2bbb662d10eebb25a43a7ab9bd935260999513db6d7ef7edd88e0
SSDEEP 1536:a6qbopMrUI6w6SEen6ibnHt2dArkPPULnjyGzZq4ObnKYfrnonsEOrSSdIHj4Tj2:cMpGUO6Sbbnjftq7mwos2g2
TLSH
T1E9E3F672560B44ACE312A9FC8C594C42F7F6B84783A0D7EF1790A47B39A56C0EBB6D11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader.exe

File Explorer

tigue.zip

.zip 153KB
Loader.exe

.exe 153KB

tigue.zip

SHA256 ae921064d3ae3bf9b21a5c3c93160acc5fc1c88517927919b519b675d896672f
MD5 211285abd1cdf335b324ae801808001a
SHA1 dbfc4a6c23ad37e3f311a490d0d78045f0354524
SHA512 b87e526614bbe033fe48aaa22f707a9ee7f277c24e8734975c7258a9bbcb629d02d7bfc7a3e2bbb662d10eebb25a43a7ab9bd935260999513db6d7ef7edd88e0
SSDEEP 1536:a6qbopMrUI6w6SEen6ibnHt2dArkPPULnjyGzZq4ObnKYfrnonsEOrSSdIHj4Tj2:cMpGUO6Sbbnjftq7mwos2g2
TLSH
T1E9E3F672560B44ACE312A9FC8C594C42F7F6B84783A0D7EF1790A47B39A56C0EBB6D11
MD5 SHA1 SHA512 SSDEEP TLSH

Loader.exe

IMPHASH 7a5014f1758921a15dc00f8435b85ab3
SHA256 62ba9d5570cab6174c2193651713a2115ae0e3421a519f0ac0f060a8317608e7
MD5 b3b2fd1e5d447ed909c98c3d941c574c
SHA1 dcfa9206ec8f25b207fe365bff9f94c7b6b2985a
SHA512 dbfc199837917e7aa138cb12406595dfc50d18086f3ea0657c3bc0400c3ba217f4e22f4554fa82d7598bee623d0b40e1228d65c686bc285287df40f8a412d402
SSDEEP 1536:X6qbopMrUI6w6SEen6ibnHt2dArkPPULnjyGzZq4ObnKYfrnonsEOrSSdIHj4Tjy:vMpGUO6Sbbnjftq7mwos2g
TLSH
T149E3F672560B44ACE312A9FC8C594C42F7F6B84783A0D7EF1790A46B39A56C0EBB6D11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Fatigue\source\repos\tigue\Loader\x64\Release\Loader.pdb

kernel32

WaitForSingleObject ReleaseMutex GetTempPathA GetLastError GetFileAttributesA CreateFileA DeleteFileA CreateMutexA LocalFree GetDiskFreeSpaceExA CreateDirectoryA FormatMessageA GetTempFileNameA GetExitCodeProcess GetEnvironmentVariableA TerminateProcess SetConsoleTitleA GetFileSizeEx MoveFileA CloseHandle GetModuleFileNameA InitializeSListHead GetSystemTimeAsFileTime AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId ReleaseSRWLockExclusive

advapi32

CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteExA

msvcp140

_Mtx_lock _Query_perf_counter _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xlength_error@std@@YAXPEBD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?eof@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

wininet

InternetReadFile HttpQueryInfoA InternetGetConnectedState InternetCloseHandle InternetOpenUrlA InternetOpenA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context _CxxThrowException memcmp __C_specific_handler __std_terminate memcpy memset __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _initterm _initterm_e _exit _initialize_onexit_table __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _get_initial_narrow_environment terminate exit _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fflush fputc fgetpos __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetc fopen_s fwrite fclose __stdio_common_vfprintf __stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-string-l1-1-0

_strnicmp strlen

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale