download[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
download.exe
Size 3.6MB
Sample261011-3gf1mabc63
SHA256 b5c3615aff20fe2d566ce68fc9409ad182ab2776c600c1cf61e177b3a982de59
MD5 c66eb6d42a9009bafb80d125f65cbd38
SHA1 e000ee967dd81ee27b41230337763a08e9e18d75
SHA512 ac70013ef54b807d825d799fc77d6c1e3ae7bb08b3a2ad8086e593ec0a7d3e1aea72cf08eb4932cc5e3e0335f21d52e21c9837bae7d6267ab63013909784c8d0
SSDEEP 49152:QOADyTlJwdID39HPmA5xeMzVV87FILdtIW610s6d3rvNAfVdVojlThuylTA:ouRlttU+9m0sc+dVojru
TLSH
T19406AE11BA41A024F8FB01F649FE91BC997CFDB04BA854C792C46AEE96356E17E31343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
download.exe

File Explorer

download.exe

.exe 3.6MB

download.exe

IMPHASH 1ea71961d6fe48a7a03c710ec32a70ae
SHA256 b5c3615aff20fe2d566ce68fc9409ad182ab2776c600c1cf61e177b3a982de59
MD5 c66eb6d42a9009bafb80d125f65cbd38
SHA1 e000ee967dd81ee27b41230337763a08e9e18d75
SHA512 ac70013ef54b807d825d799fc77d6c1e3ae7bb08b3a2ad8086e593ec0a7d3e1aea72cf08eb4932cc5e3e0335f21d52e21c9837bae7d6267ab63013909784c8d0
SSDEEP 49152:QOADyTlJwdID39HPmA5xeMzVV87FILdtIW610s6d3rvNAfVdVojlThuylTA:ouRlttU+9m0sc+dVojru
TLSH
T19406AE11BA41A024F8FB01F649FE91BC997CFDB04BA854C792C46AEE96356E17E31343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\amir\Desktop\Tracy\Clock\bin\Win32\Release\miniClock.pdb

gdiplus

GdiplusShutdown GdiplusStartup GdipSetStringFormatFlags GdipSetStringFormatAlign GdipCreatePen1 GdipDeletePen GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipCloneBrush GdipCreateStringFormat GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetPenStartCap GdipDeleteBrush GdipAlloc GdipCreateLineBrushFromRect GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipSetStringFormatTrimming GdipGraphicsClear GdipDrawLine GdipFree GdipDrawString GdipCreateFromHDC GdipFillEllipse GdipSetPenEndCap GdipSetTextRenderingHint GdipDrawEllipse

ole32

CoAddRefServerProcess CoReleaseServerProcess CoUninitialize CoRegisterClassObject CoResumeClassObjects CoInitializeEx CoRevokeClassObject StringFromGUID2

oleaut32

SysAllocString DispGetIDsOfNames LoadTypeLibEx CreateErrorInfo SetErrorInfo DispInvoke

advapi32

RegOpenKeyExW RegDeleteTreeW RegCreateKeyExW RegDeleteKeyExW RegCloseKey EnumDynamicTimeZoneInformation RegSetValueExW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

user32

ShowWindow SetTimer MapWindowPoints LoadIconW LoadCursorW SetWindowLongW GetClientRect KillTimer SetForegroundWindow SetWindowTextW IsIconic BeginPaint EndPaint IsWindow GetMessageW MessageBoxW DispatchMessageW TranslateMessage PostThreadMessageW SetProcessDPIAware RegisterClassExW CreateWindowExW DestroyWindow SetWindowPos GetWindowRect AdjustWindowRectEx DefWindowProcW GetWindowLongW InvalidateRect

gdi32

CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteDC DeleteObject

kernel32

GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTimeEx GetConsoleOutputCP GetConsoleMode DecodePointer CreateFileW CreateFileA CreateDirectoryW SizeofResource WriteFile WriteConsoleW LockResource CloseHandle LoadResource FindResourceW GetModuleHandleW WideCharToMultiByte GetCommandLineW GetModuleFileNameW GetCurrentThreadId FormatMessageW LocalFree LoadLibraryW GetProcAddress FreeLibrary GetLastError GetLocalTime GetDynamicTimeZoneInformation

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

download.exe

gdiplus

ole32

oleaut32

advapi32

shell32

user32

gdi32

kernel32

generic