sine-win-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
sine-win-x64.exe
Size 2.7MB
Sample260930-l4vc4aydkc
SHA256 5cc6bc9d4e00a78059aa47217b0a0db3e52438354d1988c35ddf8aebda3a8dde
MD5 b01f6a85a78307e01d7e677709ee0269
SHA1 8f3c5cd5b61375699722c9865c966756e9acc831
SHA512 dc26fd4b305c373855b7342c9670bde8bf6c5d0ca2445f0709d46b6d254aae1e5b8416e8f78f865a078dd201feed00ec5b45b209c395a47c5e7c9dc39812e027
SSDEEP 49152:mKJR7JJsXpNbJCp9Z41Sx8cQF6T/3FndmCGea2xE+ilCKczx:my/s8p9Z41Sx8cQF6T6G/xE+ilCKc
TLSH
T11ED5AD57E3BAC1A5D92BA471CA417712D7773805DBF1A3CF618C29288E979E01E383D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sine-win-x64.exe

File Explorer

sine-win-x64.exe

.exe 2.7MB

sine-win-x64.exe

IMPHASH e58429a20673b65b7fb33588c815d15c
SHA256 5cc6bc9d4e00a78059aa47217b0a0db3e52438354d1988c35ddf8aebda3a8dde
MD5 b01f6a85a78307e01d7e677709ee0269
SHA1 8f3c5cd5b61375699722c9865c966756e9acc831
SHA512 dc26fd4b305c373855b7342c9670bde8bf6c5d0ca2445f0709d46b6d254aae1e5b8416e8f78f865a078dd201feed00ec5b45b209c395a47c5e7c9dc39812e027
SSDEEP 49152:mKJR7JJsXpNbJCp9Z41Sx8cQF6T/3FndmCGea2xE+ilCKczx:my/s8p9Z41Sx8cQF6T6G/xE+ilCKc
TLSH
T11ED5AD57E3BAC1A5D92BA471CA417712D7773805DBF1A3CF618C29288E979E01E383D8
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

prove

Minor OS version

Major OS version

Entry point

931548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

advapi32

CryptHashData CryptEncrypt CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptDestroyKey CryptDestroyHash CryptImportKey

crypt32

CertAddCertificateContextToStore CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertGetCertificateChain CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine

secur32

InitSecurityInterfaceW

ws2_32

socket ntohs WSAStartup WSACleanup accept bind connect WSAWaitForMultipleEvents getsockname recv setsockopt WSASetLastError htons __WSAFDIsSet select htonl listen getaddrinfo WSAEventSelect freeaddrinfo recvfrom sendto ioctlsocket gethostname WSAGetLastError WSAResetEvent WSAIoctl WSAEnumNetworkEvents WSACreateEvent closesocket WSACloseEvent send getsockopt getpeername

iphlpapi

if_nametoindex

kernel32

SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindClose CreateDirectoryW GetCurrentThreadId FindFirstFileW GetTempPathA CloseHandle WaitForSingleObject CreateProcessA GetFileInformationByHandleEx CreateToolhelp32Snapshot Process32First Process32Next OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte Sleep FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleW SetThreadExecutionState QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree VerSetConditionMask GetLastError GetModuleHandleExW FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx SleepEx GetTickCount SetLastError GetFullPathNameW MoveFileExW WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetModuleHandleA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateFileW GetFileSizeEx LocalFree GetLocaleInfoEx FormatMessageA AreFileApisANSI GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar IsDebuggerPresent

user32

UnregisterClassW UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData ToUnicode ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplaySettingsExW EnumDisplayDevicesW EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect OffsetRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW RemovePropW GetRawInputDeviceInfoA SetPropW ReleaseDC GetDC SetForegroundWindow GetSystemMetrics MsgWaitForMultipleObjects ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindow SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW WaitMessage PostMessageW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent SetWindowLongPtrW GetWindowLongPtrW GetRawInputDeviceList GetPropA SetPropA CallWindowProcW GetMessageExtraInfo EmptyClipboard GetPropW GetClipboardData SetClipboardData CloseClipboard OpenClipboard

gdi32

SwapBuffers CreateBitmap SetPixelFormat DescribePixelFormat ChoosePixelFormat SetDeviceGammaRamp GetDeviceGammaRamp GetDeviceCaps DeleteDC CreateDCW CreateDIBSection DeleteObject CreateRectRgn

shell32

DragAcceptFiles DragQueryFileW DragQueryPoint ShellExecuteW DragFinish

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency _Query_perf_counter ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

vcruntime140

memcmp memcpy memmove memset strstr strchr strrchr wcschr __C_specific_handler __current_exception __current_exception_context __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _cexit _c_exit _register_thread_local_exe_atexit_callback abort __sys_nerr __p___argv __sys_errlist _initialize_onexit_table _register_onexit_function _crt_atexit terminate _errno _invoke_watson _set_app_type

api-ms-win-crt-stdio-l1-1-0

_close _fileno fclose _read fflush fgets _wopen __stdio_common_vsprintf _write _lseeki64 __stdio_common_vfprintf fgetc ftell fseek _wfopen __acrt_iob_func feof fgetpos fputc fread fputs __stdio_common_vsscanf _get_stream_buffer_pointers fsetpos _fseeki64 __p__commode _set_fmode fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _fullpath remove _wstat64 _unlock_file _stat64i32 _fstat64 _unlink

api-ms-win-crt-string-l1-1-0

tolower strncpy strcpy strspn wcscmp wcscpy _strdup strncmp strcmp wcsncmp strpbrk strcspn strlen wcsncpy wcslen

api-ms-win-crt-heap-l1-1-0

free realloc malloc _set_new_mode _callnewh calloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

fmaxf fmodf powf fminf _fdopen acosf cosf sinf ceilf sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

wcstombs atoi strtoul

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale