xlr8[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xlr8.exe
Size 1.1MB
Sample260930-r7ckcaad78
SHA256 13f4396bd5b236b0f5c7bf3cb9d386ec842ab73017b930cc312995326c03b170
MD5 871704e2078b89c80eef74ca86122125
SHA1 ae273304e3e8419bd1334aa0ae1b065b2cf9858f
SHA512 efeebed5985c064432b5e2a142cf59993ebad6a58dcda11b6a0a8c696d1f2714eb32c3b23abc94d02dc3cc99401cb9df8f0cc28450f158b3a618fe7e5415e55a
SSDEEP 24576:DOvKl3msFIL58H3Tl8kZ1eDfrEOgUHoEisIeCBC4em0o:1msFIL5QR8wirERkisjPw
TLSH
T17E45BF55B3A412B5E3B6D534CD824412FA72BC494F3099DB43B299662F236E38F3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xlr8.exe

File Explorer

xlr8.exe

.exe 1.1MB

xlr8.exe

IMPHASH f2e7d9782515a463bf50cb2be95ae567
SHA256 13f4396bd5b236b0f5c7bf3cb9d386ec842ab73017b930cc312995326c03b170
MD5 871704e2078b89c80eef74ca86122125
SHA1 ae273304e3e8419bd1334aa0ae1b065b2cf9858f
SHA512 efeebed5985c064432b5e2a142cf59993ebad6a58dcda11b6a0a8c696d1f2714eb32c3b23abc94d02dc3cc99401cb9df8f0cc28450f158b3a618fe7e5415e55a
SSDEEP 24576:DOvKl3msFIL58H3Tl8kZ1eDfrEOgUHoEisIeCBC4em0o:1msFIL5QR8wirERkisjPw
TLSH
T17E45BF55B3A412B5E3B6D534CD824412FA72BC494F3099DB43B299662F236E38F3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

255024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MoveFileExW GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte CreateFileMappingW MapViewOfFile QueryPerformanceCounter SetDllDirectoryW MulDiv VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect LocalFree GetConsoleMode GetConsoleOutputCP HeapAlloc GetFileType SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread GetCurrentProcess FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetProcAddress SwitchToThread FindResourceW LoadResource HeapSetInformation GetSystemInfo CloseHandle DeleteFileW QueryPerformanceFrequency LockResource GetCurrentThread SetEvent GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateEventW SetProcessMitigationPolicy OpenProcess UnmapViewOfFile GetSystemDirectoryW CreateFileW WaitForSingleObject GetEnvironmentVariableW GetProcessMitigationPolicy SetThreadPriority CompareStringOrdinal WaitForMultipleObjects GetModuleFileNameW TerminateProcess HeapFree GetCommandLineW SetDefaultDllDirectories GetFileSizeEx SizeofResource ReadFile LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId AcquireSRWLockExclusive RtlUnwind ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetTempPathW SetFileInformationByHandle GetFinalPathNameByHandleW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW WriteFile FlsFree SetThreadAffinityMask

user32

BeginPaint GetCursorPos ReleaseDC IsIconic InvalidateRect LoadImageW SetForegroundWindow ReleaseCapture UpdateWindow GetParent SetProcessDPIAware EnumDisplaySettingsW PostQuitMessage KillTimer GetKeyNameTextW DrawIconEx DrawTextW UpdateLayeredWindow GetClientRect SetCapture LoadCursorW TranslateMessage SetPropW SetFocus SetLayeredWindowAttributes MoveWindow GetForegroundWindow SendInput SetWindowDisplayAffinity TrackMouseEvent GetMonitorInfoW DestroyIcon RedrawWindow SetTimer DispatchMessageW GetCapture GetAsyncKeyState IsWindow ShowWindow RegisterClassExW GetWindowLongPtrW MessageBeep SetWindowTextW GetSystemMetrics CreateWindowExW FillRect SetWindowLongPtrW MonitorFromWindow GetPropW GetDpiForWindow MessageBoxW SetWindowPos IsWindowVisible GetDC DestroyWindow RemovePropW SendMessageW EndPaint GetWindowTextW RegisterHotKey AdjustWindowRectEx GetFocus GetWindowTextLengthW GetMessageW DefWindowProcW MapVirtualKeyW UnregisterHotKey GetKeyState CallWindowProcW PostMessageW ScreenToClient

gdi32

BitBlt CreateCompatibleBitmap SaveDC SelectObject GetWindowExtEx GetBkMode CreateCompatibleDC CreateFontW SetWindowOrgEx SetWindowExtEx GetWindowOrgEx SetViewportExtEx GetTextMetricsW DeleteDC TextOutW GetTextExtentPoint32W SetTextColor SetBkMode SetViewportOrgEx GetViewportExtEx GetTextColor ExcludeClipRect SetBkColor RestoreDC LPtoDP DeleteObject CreateSolidBrush SetMapMode GetMapMode GetViewportOrgEx

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegGetValueW

shell32

ShellExecuteW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect

dwmapi

DwmSetWindowAttribute

gdiplus

GdipClosePathFigure GdipCreateFromHDC GdipFillEllipseI GdipFillEllipse GdipSetPenEndCap GdipSetSmoothingMode GdipDeleteGraphics GdipFillPath GdipCreateSolidFill GdipCreatePath GdipDrawPath GdipSetCompositingMode GdipDrawLines GdipDeletePen GdipCreatePen1 GdipFillRectangleI GdipSetPenLineJoin GdipDeletePath GdipSetPixelOffsetMode GdiplusStartup GdiplusShutdown GdipAddPathRectangleI GdipAddPathArcI GdipCreateLineBrushI GdipSetPenStartCap GdipDeleteBrush

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash BCryptGetProperty

crypt32

CryptUnprotectData CryptProtectData

winmm

waveOutWrite waveOutUnprepareHeader waveOutClose waveOutOpen waveOutPrepareHeader waveOutReset

Name

.text

Size

402KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

584KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xlr8.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winhttp

dwmapi

gdiplus

bcrypt

crypt32

winmm

generic