Scratch 2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Scratch 2.exe
Size 223KB
Sample261002-kl567stsgy
SHA256 4b47e557572ed842d16940ac7bc5371238cc7f58d221bf5668c53d8744aa42f0
MD5 a68c6dd020a1781e2ebc869c1b01dd5c
SHA1 c9ef6bd80f94229c2fbadbc470e606585c9394d9
SHA512 7894675503e16509442a74fe15a67a88bddbc3daf6b5506c8436d6da5ccfb89494ccee1fd65f1ec20b4488e92521a14c48c1f234bd0a7c4b06ae7c33717a3ed3
SSDEEP 1536:GtbnV5fy9QvIOPwl4UG55kNqRGpgSvqb2QravA+mH0gpEp5mJ:8fCnre56Oprav7mH0gpEp5mJ
TLSH
T11224A662F144CC7ADC571BB6D86AD1102A67BD2989B0510F39F93E1E39B339110ABF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Scratch 2.exe

File Explorer

Scratch 2.exe

.exe 223KB

Scratch 2.exe

IMPHASH 0149ed03f5810d92496c2f5e11b99ce2
SHA256 4b47e557572ed842d16940ac7bc5371238cc7f58d221bf5668c53d8744aa42f0
MD5 a68c6dd020a1781e2ebc869c1b01dd5c
SHA1 c9ef6bd80f94229c2fbadbc470e606585c9394d9
SHA512 7894675503e16509442a74fe15a67a88bddbc3daf6b5506c8436d6da5ccfb89494ccee1fd65f1ec20b4488e92521a14c48c1f234bd0a7c4b06ae7c33717a3ed3
SSDEEP 1536:GtbnV5fy9QvIOPwl4UG55kNqRGpgSvqb2QravA+mH0gpEp5mJ:8fCnre56Oprav7mH0gpEp5mJ
TLSH
T11224A662F144CC7ADC571BB6D86AD1102A67BD2989B0510F39F93E1E39B339110ABF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\results\Release\info\ExtendedAppEntry.pdb

kernel32

SetStdHandle GetVersionExW ExitProcess GetUserDefaultUILanguage GetModuleHandleW WriteConsoleW GetStdHandle GetCommandLineW HeapAlloc GetProcessHeap GetFullPathNameW HeapFree GetFileAttributesW LoadLibraryW GetProcAddress CreateFileW InitializeCriticalSection GetLastError DuplicateHandle GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetFileType GetCommandLineA GetStartupInfoA CloseHandle SetHandleCount DeleteCriticalSection Sleep TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetLastError InitializeCriticalSectionAndSpinCount WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc RtlUnwind LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP SetFilePointer CreateFileA GetModuleFileNameW

shell32

CommandLineToArgvW

user32

FindWindowA ShowWindow MessageBoxExW

shlwapi

PathAppendW StrCmpW PathRemoveFileSpecW

msi

ord90