client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
client.exe
Size 25.7MB
Sample261001-y64e1abc32
SHA256 320783b0e2e83b3816c2959530c24ff378d1c75bda3d4caeb18f6993edd4c30b
MD5 ad1f2b91d31bde5eec3910ead5161ec9
SHA1 f310590a7b13edd7fc565e66e2f2d53313a493aa
SHA512 490da85a892287bb4214da22ed06639da46b31f7afbedf5b661751c1ee0e9f8c3e64518ec1bfbf441ba436bf671c15729a76078a31eddb3f4a280c49018a7322
SSDEEP 12288:RMy+ScOkwUvttcmd7FCAy03N8KO5E5xTlXXfAWqH49pB5+d:VcvwUvwmZFw0yKOW5ffAEpn+d
TLSH
T1A3476D26ABA800FDE177D1B8CA535903FBB1B84643346ADF03905A661F177D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 25.7MB

client.exe

IMPHASH a7ce6c9bae8287f90c2691680eda3663
SHA256 320783b0e2e83b3816c2959530c24ff378d1c75bda3d4caeb18f6993edd4c30b
MD5 ad1f2b91d31bde5eec3910ead5161ec9
SHA1 f310590a7b13edd7fc565e66e2f2d53313a493aa
SHA512 490da85a892287bb4214da22ed06639da46b31f7afbedf5b661751c1ee0e9f8c3e64518ec1bfbf441ba436bf671c15729a76078a31eddb3f4a280c49018a7322
SSDEEP 12288:RMy+ScOkwUvttcmd7FCAy03N8KO5E5xTlXXfAWqH49pB5+d:VcvwUvwmZFw0yKOW5ffAEpn+d
TLSH
T1A3476D26ABA800FDE177D1B8CA535903FBB1B84643346ADF03905A661F177D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

316752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

advapi32

RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken GetUserNameW LookupPrivilegeValueA

user32

wsprintfW

kernel32

GetCommandLineW GetEnvironmentStringsW GetCommandLineA FreeEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile GetFileAttributesExW GetFileType EnumSystemLocalesW GetEnvironmentVariableW CreateFileW DeleteFileW GetFileSizeEx GetLogicalDrives ReadFile WriteFile GetTempPathW CloseHandle WaitForSingleObject Sleep CreateProcessW GetTickCount64 LocalFree CopyFileW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableA CreateFileA DeleteFileA FindClose FindFirstFileA FindFirstFileW FindNextFileA GetFileAttributesA GetFileAttributesW GetFileSize GetTempPathA GetLastError ResetEvent CreateEventW GetCurrentProcess GetCurrentProcessId TerminateProcess CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress LoadLibraryW QueryFullProcessImageNameW CopyFileA CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageA GetLocaleInfoEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive FindFirstFileExW FindNextFileW RtlUnwind CreateFile2 AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetUserDefaultLCID RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW ExitProcess HeapAlloc HeapFree HeapReAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale

Name

.text

Size

456KB

Virtual Size

455KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.padsec

Size

25.0MB

Virtual Size

25.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client.exe

winhttp

crypt32

bcrypt

ncrypt

advapi32

user32

kernel32

generic