Infection_External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Infection_External.exe
Size 6.8MB
Sample261003-3sn6dazamd
SHA256 c21422c995b64b0a995cd9f1a8457a829913c70e6699012f6a55ca34e9d95e98
MD5 addf16a9765280cf5fbbbccc6c01b41e
SHA1 77f81d95376c8bb453292f75b69283177f914333
SHA512 5c9f88d04390ec1b35f2bd3fd61958431fb83fc9b7b9565f64ecc017e7137225e0045cbcbd697c611c13a5e488ff8848c160ed267468e918e945627baab6b828
SSDEEP 196608:fzLnpw9rW1lpQd58NDcrPWKu63eOOXTEZA4OOzYywFCjmv5PCkLzcUasz0LIG:Xnpw9rW1lpQd58NDcrPWKu63eOOXTEZP
TLSH
T16266E08B63A400E8D126C8BCC94B5723E2717C4C4730AAEB6ED48E561F977E0B67E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Infection_External.exe

File Explorer

Infection_External.exe

.exe 6.8MB

Infection_External.exe

IMPHASH a1969de97a65334b5f4baff459fbf90e
SHA256 c21422c995b64b0a995cd9f1a8457a829913c70e6699012f6a55ca34e9d95e98
MD5 addf16a9765280cf5fbbbccc6c01b41e
SHA1 77f81d95376c8bb453292f75b69283177f914333
SHA512 5c9f88d04390ec1b35f2bd3fd61958431fb83fc9b7b9565f64ecc017e7137225e0045cbcbd697c611c13a5e488ff8848c160ed267468e918e945627baab6b828
SSDEEP 196608:fzLnpw9rW1lpQd58NDcrPWKu63eOOXTEZA4OOzYywFCjmv5PCkLzcUasz0LIG:Xnpw9rW1lpQd58NDcrPWKu63eOOXTEZP
TLSH
T16266E08B63A400E8D126C8BCC94B5723E2717C4C4730AAEB6ED48E561F977E0B67E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2443968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Sources\Rebrands\Advanced\Jamaica\Jamaica Novo\x64\Release\Infection External.pdb

d3dx9_43

D3DXVec3Normalize D3DXVec3Transform D3DXMatrixTranspose

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

Process32NextW Process32FirstW GetCurrentProcessId QueryFullProcessImageNameW SetUnhandledExceptionFilter GetLocaleInfoA InitializeSListHead GetStartupInfoW WakeAllConditionVariable CreateFileA GetFileSizeEx ReadFile HeapAlloc GetFileInformationByHandleEx HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetTickCount64 SleepConditionVariableSRW GetCurrentThreadId LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetPriorityClass QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress GlobalAlloc GetLastError Sleep WaitForSingleObject GetVolumeInformationA GetEnvironmentVariableA TerminateProcess OutputDebugStringA GetCurrentProcess ReadProcessMemory CloseHandle CreateToolhelp32Snapshot OpenProcess Module32First Module32Next VirtualFreeEx GlobalFree QueryPerformanceFrequency WideCharToMultiByte LoadLibraryA MultiByteToWideChar Beep GetModuleHandleA GetComputerNameA GlobalUnlock GetTickCount CreateDirectoryA GetSystemTimeAsFileTime CreateRemoteThread ExitProcess GlobalLock VirtualProtectEx GetWindowsDirectoryA GetModuleHandleW AreFileApisANSI CreateFile2 SetFileInformationByHandle VirtualAllocEx

user32

GetMonitorInfoA MessageBoxA SetWindowDisplayAffinity EmptyClipboard CloseClipboard OpenClipboard GetSystemMetrics EnumDisplayMonitors SetWindowPos SetCursorPos ShowCursor UpdateWindow FindWindowA PostQuitMessage GetWindowLongPtrA PeekMessageA ClipCursor TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow SetWindowLongA IsWindow ShowWindow SetClipboardData UnregisterClassW CreateWindowExW MessageBoxW DestroyWindow GetWindowRect DispatchMessageA GetKeyState GetWindowThreadProcessId GetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo SendInput GetClipboardData GetAsyncKeyState GetForegroundWindow RegisterClassExW

advapi32

CryptAcquireContextA CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptHashData RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueA GetUserNameA AdjustTokenPrivileges OpenProcessToken GetTokenInformation

shell32

ShellExecuteA SHQueryUserNotificationState SHGetFolderPathA

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_trylock _Thrd_yield ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??7ios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringW ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

ws2_32

connect bind WSAGetLastError send recv closesocket getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo ntohl gethostname sendto recvfrom WSAIoctl

normaliz

IdnToAscii

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertOpenStore

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

wininet

InternetQueryOptionA HttpOpenRequestA InternetSetOptionA HttpAddRequestHeadersA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpQueryInfoA

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate strstr strchr __std_type_info_compare __RTtypeid strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh free malloc calloc

api-ms-win-crt-string-l1-1-0

toupper _stricmp strncpy strcmp strncmp strncpy_s isdigit isalnum _strdup towlower _wcsnicmp wcslen isupper strpbrk strspn strcspn strcpy_s tolower strlen _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _beginthreadex _getpid __sys_nerr abort _crt_atexit _errno strerror exit _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _register_onexit_function _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e terminate _exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

ungetc fread __stdio_common_vsscanf fgetpos fputs fwrite _fseeki64 feof _get_stream_buffer_pointers fgetc __stdio_common_vsprintf_s fopen _open _set_fmode fclose ftell fflush fseek _wfopen fputc __p__commode _read _write __stdio_common_vfprintf _close __acrt_iob_func fsetpos __stdio_common_vsprintf fgets setvbuf _lseeki64

api-ms-win-crt-convert-l1-1-0

strtoul strtol strtod strtoll strtoull atoi atof mbstowcs

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s _gmtime64 _time64 _mkgmtime64

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr acosf atan2f ceilf cosf expf fmodf log logf pow powf sinf sqrt sqrtf _hypotf

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _access remove _stat64 _lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv