HC🔒[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
HC🔒.exe
Size 61KB
Sample261003-x2cwtawblc
SHA256 23ecbe85e66f0d484f1a2f9fa86708a1f72f078461f803239d89125c8bcb2dae
MD5 8cfe0b9a227b7aa9b74ffe036a08e1f4
SHA1 2caae18c3016243f733903371b7f231c5af066f2
SHA512 8ef5e51b6ce006b3fbb63b5ea7150b2b40284972345cae75939f770d4b628f9cd48615567976a8c53a6719393d5db7b765bded685366447da18a50e094c22f5f
SSDEEP 768:NqxGP/arXYR16XzlYqYjd1CQeDgHwe54ntv5YNzc34F4oHUA:NIGoIR16XzlOjecHJ54ntvaNzcG4TA
TLSH
T13B5318269923103AC21799B89B934601AE31FC438B82EACB3F9C5DD50F95ED4DF7A704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HC🔒.exe

File Explorer

HC🔒.exe

.exe .js 61KB

HC🔒.exe

IMPHASH 35b4221b77a33a41769ae7178d66eb9b
SHA256 23ecbe85e66f0d484f1a2f9fa86708a1f72f078461f803239d89125c8bcb2dae
MD5 8cfe0b9a227b7aa9b74ffe036a08e1f4
SHA1 2caae18c3016243f733903371b7f231c5af066f2
SHA512 8ef5e51b6ce006b3fbb63b5ea7150b2b40284972345cae75939f770d4b628f9cd48615567976a8c53a6719393d5db7b765bded685366447da18a50e094c22f5f
SSDEEP 768:NqxGP/arXYR16XzlYqYjd1CQeDgHwe54ntv5YNzc34F4oHUA:NIGoIR16XzlOjecHJ54ntvaNzcG4TA
TLSH
T13B5318269923103AC21799B89B934601AE31FC438B82EACB3F9C5DD50F95ED4DF7A704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Gebruiker\source\repos\HC🔒\x64\Release\HC🔒.pdb

kernel32

WinExec GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

ws2_32

bind closesocket accept WSACleanup inet_addr send socket recv htons setsockopt listen WSAStartup

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memset __std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _set_app_type __p___argc __p___argv _c_exit _get_initial_narrow_environment _seh_filter_exe _cexit terminate _crt_atexit _initterm _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen