myproject5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
myproject5.exe
Size 452KB
Sample260930-ppj6csv1bv
SHA256 981a3b802fa9a72aab862821885369e969b5afc1915a43bdeaf410f343fb14bf
MD5 903f7672da8fea06987dea5267bb1d98
SHA1 29b21f42b600a6b55b343a7ab34319c512c0af09
SHA512 7fd4a5755110b34509b8894782441de8166ef7e59bd4830dc1e497bea9049d0022c5487131fa1eb7c50665f1ba270897515706b3f6d3f9081a418ae40635763c
SSDEEP 6144:tRqV1Bdgw8XbhlweIKedSMaxTnLkr3k78yRMalI2AJhKsGWqd6cBCTbDuzOsGn/b:tRc1BdX8LnZIQnOyRZhEqN8/O
TLSH
T1D0A47D87F28400EDE856E13D938ED226F9727C940351E5CF23A0A2312E67AE49E7DF55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
myproject5.exe

File Explorer

myproject5.exe

.exe 452KB

myproject5.exe

IMPHASH 6b609f0b1d2896ff783d3d07f6aea539
SHA256 981a3b802fa9a72aab862821885369e969b5afc1915a43bdeaf410f343fb14bf
MD5 903f7672da8fea06987dea5267bb1d98
SHA1 29b21f42b600a6b55b343a7ab34319c512c0af09
SHA512 7fd4a5755110b34509b8894782441de8166ef7e59bd4830dc1e497bea9049d0022c5487131fa1eb7c50665f1ba270897515706b3f6d3f9081a418ae40635763c
SSDEEP 6144:tRqV1Bdgw8XbhlweIKedSMaxTnLkr3k78yRMalI2AJhKsGWqd6cBCTbDuzOsGn/b:tRc1BdX8LnZIQnOyRZhEqN8/O
TLSH
T1D0A47D87F28400EDE856E13D938ED226F9727C940351E5CF23A0A2312E67AE49E7DF55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CryptAcquireContextW CryptDecrypt CryptDestroyKey CryptImportKey CryptReleaseContext CryptSetKeyParam FreeSid RegCloseKey RegCreateKeyExW RegDeleteTreeW RegSetValueExW

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf _fileno _fseeki64 _ftelli64 _setmode fclose fflush fopen_s fputc fputs fread freopen_s fwrite

api-ms-win-crt-filesystem-l1-1-0

_stat64 remove

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_localtime64 _mktime64 _time64 _utime64

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp wcslen

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetLastError GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTempPathW GetThreadId InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadResource LockResource MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-math-l1-1-0

__setusermatherr

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

Name

.text

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

myproject5.exe

advapi32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

ntdll

api-ms-win-crt-environment-l1-1-0

generic