dobrota[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dobrota.exe
Size 14.4MB
Sample260930-x4d7nasalf
SHA256 52b65693427033b003bba52a10dd9b7223d06acfc41dbe52f5d408e69a521a0d
MD5 284319d621e8f3922b4b98b7096d40ce
SHA1 0b1a72436ee43d769c4a36085336190077380dee
SHA512 481f7c5728c6155ce4e57f4935492597ca263103eda58781bba00b7a8dfb067aace6dc1faac4e520c58e92ca5d73d04aec88d59102be7db5386efc4129ad223b
SSDEEP 196608:1Q9J32KR45ZVE8lj8NsFWCNffyA5EAK4Yniwm5nD1PJlJ32KRDS8:6fhcjVFWonyA2AKhni11PthI8
TLSH
T14DE6CF11FA876DB2EC8667F020C3733A6338EE20C769DA37B944FD2496736C4652A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dobrota.exe

File Explorer

dobrota.exe

.exe 14.4MB

dobrota.exe

IMPHASH 29b9cc44d3e2287540325b486d563745
SHA256 52b65693427033b003bba52a10dd9b7223d06acfc41dbe52f5d408e69a521a0d
MD5 284319d621e8f3922b4b98b7096d40ce
SHA1 0b1a72436ee43d769c4a36085336190077380dee
SHA512 481f7c5728c6155ce4e57f4935492597ca263103eda58781bba00b7a8dfb067aace6dc1faac4e520c58e92ca5d73d04aec88d59102be7db5386efc4129ad223b
SSDEEP 196608:1Q9J32KR45ZVE8lj8NsFWCNffyA5EAK4Yniwm5nD1PJlJ32KRDS8:6fhcjVFWonyA2AKhni11PthI8
TLSH
T14DE6CF11FA876DB2EC8667F020C3733A6338EE20C769DA37B944FD2496736C4652A745
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset strncmp memmove strncpy strstr _strnicmp _stricmp strlen strcmp strcpy strcat memcpy sprintf fabs ceil malloc floor free fclose tolower

kernel32

GetModuleHandleA HeapCreate SetConsoleCtrlHandler GetCommandLineA RemoveDirectoryA GetTempFileNameA GetShortPathNameA GetWindowsDirectoryA GetSystemDirectoryA HeapDestroy ExitProcess GetNativeSystemInfo FindResourceA LoadResource SizeofResource HeapAlloc HeapFree Sleep LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId CloseHandle InitializeCriticalSection GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA GetCurrentProcess DuplicateHandle CreatePipe GetStdHandle CreateProcessA WaitForSingleObject EnterCriticalSection LeaveCriticalSection TerminateProcess GetExitCodeProcess CreateFileA ReadFile WriteFile SetFilePointer DeleteFileA GetFileSize HeapReAlloc SetUnhandledExceptionFilter GetVersionExA SetLastError HeapSize TlsAlloc GetCurrentDirectoryA SetCurrentDirectoryA GetTempPathA SetFileAttributesA CreateDirectoryA DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte

user32

CharUpperA CharLowerA MessageBoxA SendMessageA PostMessageA GetWindowThreadProcessId IsWindowVisible GetWindowLongA GetForegroundWindow IsWindowEnabled EnableWindow EnumWindows SetWindowPos DestroyWindow GetDC GetWindowTextLengthA GetWindowTextA SetRect DrawTextA GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush CreateWindowExA CallWindowProcA SetWindowLongA SetFocus RedrawWindow RemovePropA DefWindowProcA SetPropA GetParent GetPropA GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRectEx ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA GetActiveWindow TranslateAcceleratorA TranslateMessage DispatchMessageA GetFocus GetClientRect FillRect EnumChildWindows DefFrameProcA GetWindowRect IsChild GetClassNameA GetKeyState DestroyIcon RegisterWindowMessageA

gdi32

GetStockObject SelectObject SetBkColor SetTextColor GetTextExtentPoint32A CreateSolidBrush DeleteObject GetObjectA CreateCompatibleDC GetDIBits DeleteDC GetObjectType CreateDIBSection BitBlt CreateBitmap SetPixel

comctl32

InitCommonControlsEx

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

shlwapi

PathQuoteSpacesA PathGetArgsA PathAddBackslashA PathRenameExtensionA PathUnquoteSpacesA