Kawakaburi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Kawakaburi.exe
Size 3.3MB
Sample261002-vxjsfsts4p
SHA256 2106d1183aabfca26c12074207505b5a080522888bac1cc58318dd775bea434f
MD5 6a2d3982a77eac4adff51017bc866d80
SHA1 bb940f0423ce7feb19e649ea667cc5b9255f3b74
SHA512 2588cc5c6714ca167ae9ee9dc8520b94a1f66561604647078b0ab05abfa94b155e51dac584671d3955960c99b7741d3a6cd3019ba9ae2f622e3c6ad2deff1fd2
SSDEEP 49152:MUDrStNLgMJTrHBhTjv9aNyVd5F6NCmL2z8BVRrsvRCSqIPx0QnGn1yzRrstr6wL:NaYj1Z3KBO1ruG5
TLSH
T178F57C22FA90C137D45613B05D3AEA62703DBFFCAA14904B37DC1F4D6AB1B906A1635B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kawakaburi.exe

File Explorer

Kawakaburi.exe

.exe 3.3MB

Kawakaburi.exe

IMPHASH c6314a8194a21f3dfe5ca456f174ef75
SHA256 2106d1183aabfca26c12074207505b5a080522888bac1cc58318dd775bea434f
MD5 6a2d3982a77eac4adff51017bc866d80
SHA1 bb940f0423ce7feb19e649ea667cc5b9255f3b74
SHA512 2588cc5c6714ca167ae9ee9dc8520b94a1f66561604647078b0ab05abfa94b155e51dac584671d3955960c99b7741d3a6cd3019ba9ae2f622e3c6ad2deff1fd2
SSDEEP 49152:MUDrStNLgMJTrHBhTjv9aNyVd5F6NCmL2z8BVRrsvRCSqIPx0QnGn1yzRrstr6wL:NaYj1Z3KBO1ruG5
TLSH
T178F57C22FA90C137D45613B05D3AEA62703DBFFCAA14904B37DC1F4D6AB1B906A1635B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegFlushKey RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CompareStringA CreateDirectoryA CreateEventA CreateFileA CreateFileMappingA CreateMutexA CreatePipe CreateProcessA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection EnumCalendarInfoA ExitProcess ExitThread FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileA FindNextFileA FindResourceA FlushFileBuffers FormatMessageA FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetDriveTypeA GetEnvironmentStrings GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesA GetFileSize GetFileType GetFullPathNameA GetLastError GetLocalTime GetLocaleInfoA GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHeap GetProfileStringA GetShortPathNameA GetStartupInfoA GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDirectoryA GetSystemInfo GetSystemTime GetTempPathA GetThreadLocale GetThreadPriority GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetVersion GetVersionExA GetVolumeInformationA GetWindowsDirectoryA GlobalAddAtomA GlobalAlloc GlobalDeleteAtom GlobalFree GlobalHandle GlobalLock GlobalMemoryStatus GlobalReAlloc GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedExchange InterlockedIncrement IsBadReadPtr IsDBCSLeadByte IsValidLocale LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadResource LocalAlloc LocalFree LocalLock LocalSize LocalUnlock LockResource MapViewOfFile MulDiv MultiByteToWideChar OpenEventA OpenProcess RaiseException ReadFile RemoveDirectoryA RemoveDirectoryW ResumeThread RtlUnwind SearchPathA SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetStdHandle SetThreadAffinityMask SetThreadLocale SetThreadPriority SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WinExec WriteFile lstrcmpA lstrcmpiA lstrcpyA lstrcpynA lstrlenA

mpr

WNetCloseEnum WNetEnumResourceA WNetGetUniversalNameA WNetOpenEnumA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_SetIconSize ImageList_Write ord17 ImageList_DrawEx

gdi32

BitBlt CombineRgn CopyEnhMetaFileA CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection CreateDIBitmap CreateFontIndirectA CreateHalftonePalette CreateICA CreatePalette CreatePen CreatePenIndirect CreateRectRgn CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject EndDoc EndPage EnumFontFamiliesExA EnumFontsA ExcludeClipRect ExtCreateRegion ExtTextOutA GdiFlush GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetGlyphOutlineA GetObjectA GetPaletteEntries GetPixel GetROP2 GetRgnBox GetStockObject GetSystemPaletteEntries GetTextExtentPoint32A GetTextExtentPointA GetTextMetricsA GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt PlayEnhMetaFile Polyline RealizePalette RectVisible Rectangle RestoreDC SaveDC SelectObject SelectPalette SetAbortProc SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetEnhMetaFileBits SetMapMode SetPixel SetROP2 SetStretchBltMode SetTextColor SetViewportOrgEx SetWinMetaFileBits SetWindowOrgEx StartDocA StartPage StretchBlt TextOutA UnrealizeObject

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ShellExecuteW

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginDeferWindowPos BeginPaint CallNextHookEx CallWindowProcA ChangeDisplaySettingsA CharLowerA CharLowerBuffA CharLowerW CharNextA CheckMenuItem ChildWindowFromPoint ClientToScreen CloseClipboard CreateCaret CreateIcon CreateMenu CreatePopupMenu CreateWindowExA DefFrameProcA DefMDIChildProcA DefWindowProcA DeferWindowPos DeleteMenu DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextA EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndDeferWindowPos EndPaint EnumClipboardFormats EnumDisplaySettingsA EnumThreadWindows EnumWindows EqualRect FillRect FindWindowA FrameRect GetActiveWindow GetAsyncKeyState GetCapture GetClassInfoA GetClassNameA GetClientRect GetClipboardData GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetDlgItem GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextA GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetKeyboardType GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuState GetMenuStringA GetMessagePos GetParent GetPriorityClipboardFormat GetPropA GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSystemMetrics GetTopWindow GetUpdateRect GetWindow GetWindowDC GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemA IntersectRect InvalidateRect InvertRect IsChild IsClipboardFormatAvailable IsDialogMessageA IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadBitmapA LoadCursorA LoadCursorFromFileA LoadIconA LoadKeyboardLayoutA LoadStringA MapVirtualKeyA MapWindowPoints MessageBoxA OemToCharA OffsetRect OpenClipboard PeekMessageA PostMessageA PostQuitMessage PtInRect RedrawWindow RegisterClassA RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu RemovePropA ScreenToClient ScrollWindow ScrollWindowEx SendDlgItemMessageA SendMessageA SetActiveWindow SetCapture SetCaretPos SetClassLongA SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoA SetParent SetPropA SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextA SetWindowsHookExA ShowCursor ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoA TrackPopupMenu TrackPopupMenuEx TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow WaitMessage WinHelpA WindowFromPoint wsprintfA GetSystemMenu

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

ole32

CoCreateGuid CoInitialize CoTaskMemAlloc CoUninitialize IsEqualGUID StringFromGUID2

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysReAllocStringLen SysStringLen VariantChangeTypeEx VariantClear VariantCopyInd

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

472KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ConstSeg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

DataSeg

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CodeSeg

Size

50KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

adata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kawakaburi.exe

advapi32

kernel32

mpr

version

comctl32

gdi32

shell32

user32

imm32

ole32

oleaut32

generic