External[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
External.exe
Size 3.7MB
Sample261002-kj4wcss1by
SHA256 7711a43b0804bc3ed1ce6a2fa7761e81b55f864c50e4e6a4b6a3a31f6c696435
MD5 11d1f559979c11e667839d4ba6b45e7a
SHA1 c69c76981c35534671147f66f2e799e6179e01ce
SHA512 15484990d21245215d50317ffccb1cf18ad94b2f02a8803aca0ebf85176d6807d82d4a56388f04fb49c4c342be16991e4aeea8ff3e7b9733e597fb9ae4aa592e
SSDEEP 98304:D6MTVkkSXJWFYRdtiVivLWrsI1yk4wSIKsKH:u0VTSXJWFIPKgIgnwxjK
TLSH
T11D06E186B2A550F8C46BD0389E87A117F53738990331A5EF77DD81691F737E04ABAB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
External.exe

File Explorer

External.exe

.exe 3.7MB

External.exe

IMPHASH 749af01634368bffe491c7055fc9feaf
SHA256 7711a43b0804bc3ed1ce6a2fa7761e81b55f864c50e4e6a4b6a3a31f6c696435
MD5 11d1f559979c11e667839d4ba6b45e7a
SHA1 c69c76981c35534671147f66f2e799e6179e01ce
SHA512 15484990d21245215d50317ffccb1cf18ad94b2f02a8803aca0ebf85176d6807d82d4a56388f04fb49c4c342be16991e4aeea8ff3e7b9733e597fb9ae4aa592e
SSDEEP 98304:D6MTVkkSXJWFYRdtiVivLWrsI1yk4wSIKsKH:u0VTSXJWFIPKgIgnwxjK
TLSH
T11D06E186B2A550F8C46BD0389E87A117F53738990331A5EF77DD81691F737E04ABAB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1159132

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle GetModuleFileNameW RtlCaptureStackBackTrace GetTickCount64 GetVersionExA K32GetModuleInformation AddVectoredExceptionHandler K32EnumProcessModules SetUnhandledExceptionFilter CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle ReadProcessMemory GetExitCodeProcess WriteProcessMemory GetTickCount GetLastError SetPriorityClass SetThreadPriority WaitForSingleObject GetCurrentThread CreateThread SetLastError GetSystemInfo Module32FirstW VirtualProtectEx VirtualAllocEx GetModuleHandleW FlushInstructionCache Module32NextW VirtualFreeEx VirtualQueryEx GetProcessId CompareStringOrdinal OpenProcess SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetLocaleInfoA GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetConsoleScreenBufferInfo GetOEMCP GetACP IsValidCodePage HeapReAlloc CreateProcessW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA WriteFile ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread ReadFile LoadLibraryExW GetModuleFileNameA QueryPerformanceCounter FreeLibrary GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar TlsFree TlsSetValue TlsGetValue GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency GetEnvironmentStringsW LoadLibraryA OutputDebugStringA TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection RtlUnwind EnterCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx

user32

GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetClipboardData EmptyClipboard SetClipboardData OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor LoadCursorW CloseClipboard PostQuitMessage DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes TranslateMessage SetWindowLongW UpdateWindow BeginPaint EndPaint IsWindow GetSystemMetrics SendInput GetAsyncKeyState FindWindowW MessageBoxA DefWindowProcW GetKeyState GetMessageExtraInfo SetCapture

advapi32

FreeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken AllocateAndInitializeSid CheckTokenMembership

shell32

ShellExecuteW ShellExecuteExW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

dbghelp

SymInitialize SymFromAddr

winmm

timeBeginPeriod timeEndPeriod

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpOpenRequest

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

699KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

External.exe

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_47

dwmapi

dbghelp

winmm

winhttp

d3d11

generic