Test[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Test.exe
Size 2.2MB
Sample261001-v529rssw8k
SHA256 8dd16a159dce885f9c13a1dfd0d5becf19fbf5ddbae4f81bda80e67e383fd72e
MD5 ad008f53e6fb7b25c2f867d986e0ec02
SHA1 f64d697ee2d24682716b8c760d4107cda83b9030
SHA512 94c5b281dc18b6ed4405347212c7bbc6d17a41bf3f0d6cbb207b01d420e4f1555cd6ae55fba4ed42832e285a264939bff6a9328efdbc2aea3f440e7ec1906908
SSDEEP 24576:wn9mI4DFP3CfrgvfjEnkGjr4GImZyqPOQmcybLzRCLHSPGbMYs3dIqKG:wMbsgDIHOQ7ybbPT
TLSH
T1A9B59D3662AC11C8F17BD27D8ADB4A46D6B2B409133196DB019546DD2F27EEE0B3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Test.exe

File Explorer

Test.exe

.exe 2.2MB

Test.exe

IMPHASH 58b8d3b59ba37e1f1e0b9efc5cd32a17
SHA256 8dd16a159dce885f9c13a1dfd0d5becf19fbf5ddbae4f81bda80e67e383fd72e
MD5 ad008f53e6fb7b25c2f867d986e0ec02
SHA1 f64d697ee2d24682716b8c760d4107cda83b9030
SHA512 94c5b281dc18b6ed4405347212c7bbc6d17a41bf3f0d6cbb207b01d420e4f1555cd6ae55fba4ed42832e285a264939bff6a9328efdbc2aea3f440e7ec1906908
SSDEEP 24576:wn9mI4DFP3CfrgvfjEnkGjr4GImZyqPOQmcybLzRCLHSPGbMYs3dIqKG:wMbsgDIHOQ7ybbPT
TLSH
T1A9B59D3662AC11C8F17BD27D8ADB4A46D6B2B409133196DB019546DD2F27EEE0B3F321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8641

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lakup\Documents\dev_tools\LARP HERE\Studio\test.pdb

ws2_32

WSAStartup socket shutdown setsockopt WSACleanup WSAGetLastError send select recv inet_addr htons getsockopt getsockname ioctlsocket connect closesocket __WSAFDIsSet getaddrinfo freeaddrinfo inet_ntop

gdiplus

GdipCloneImage GdipFree GdipDisposeImage GdipSaveImageToStream GdipAlloc GdipGetImageEncoders GdipCreateBitmapFromScan0 GdiplusStartup GdipGetImageEncodersSize

advapi32

RegOpenKeyExA CheckTokenMembership FreeSid GetUserNameW RegQueryValueExW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExW AllocateAndInitializeSid RegEnumValueW RegEnumKeyExA RegDeleteValueW RegCloseKey

user32

GetForegroundWindow GetSystemMetrics GetLastInputInfo SendInput ReleaseDC RedrawWindow GetWindowTextW MessageBeep SetCursorPos GetCursorPos DrawIconEx GetIconInfo EnumDisplayDevicesW SystemParametersInfoW GetMonitorInfoA EnumDisplayMonitors SetProcessDPIAware EmptyClipboard GetClipboardData SetClipboardData GetClipboardSequenceNumber CloseClipboard OpenClipboard GetDC GetCursorInfo

gdi32

DeleteDC GdiFlush CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject CreateCompatibleDC BitBlt

ole32

CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteW ShellExecuteExW SHChangeNotify

winmm

waveOutOpen waveOutClose waveOutPrepareHeader waveInReset waveInStop waveInStart waveInAddBuffer waveOutUnprepareHeader waveInUnprepareHeader waveInPrepareHeader waveOutGetNumDevs waveInClose waveOutWrite waveOutReset waveInGetNumDevs waveInGetDevCapsW waveInOpen PlaySoundW

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateMemoryBuffer MFStartup MFCreateMediaType MFCreateAttributes MFCreateSample

mfreadwrite

MFCreateSourceReaderFromMediaSource

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptDestroyKey

kernel32

IsThreadAFiber SetFilePointerEx GetFileSizeEx GetConsoleMode IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation OutputDebugStringW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers ReadConsoleW HeapSize GetConsoleOutputCP GetFileType HeapReAlloc HeapFree VirtualProtect GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ResumeThread ExitThread CreateThread IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue SetEndOfFile FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException InterlockedFlushSList LoadLibraryExW GetDateFormatW EnumSystemLocalesW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID HeapAlloc InterlockedPushEntrySList RtlPcToFileHeader GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW DeviceIoControl AreFileApisANSI CreateFile2 SetFileTime SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread WriteConsoleW FlsGetValue SetHandleInformation GetCurrentThreadId SwitchToThread WaitForSingleObjectEx GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter K32GetProcessMemoryInfo GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesA GetFileAttributesW GetFileSize GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile GetTempPathW CloseHandle RtlUnwind SetUnhandledExceptionFilter GetLastError SetErrorMode CreatePipe PeekNamedPipe WaitForSingleObject CreateMutexA CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess GetCurrentThread SetThreadPriority CreateProcessA CreateProcessW OpenProcess GlobalMemoryStatusEx GetTickCount GetTickCount64 GetSystemDirectoryA SetProcessWorkingSetSize GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalFree WinExec MulDiv QueryFullProcessImageNameW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID GetUserDefaultLocaleName SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32FirstW Process32NextW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Test.exe

ws2_32

gdiplus

advapi32

user32

gdi32

ole32

shell32

winmm

mf

mfplat

mfreadwrite

d3d11

dxgi

crypt32

bcrypt

kernel32

generic