Txcizware-Loader (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Txcizware-Loader (1).exe
Size 19.7MB
Sample261014-ffbcesfx9y
SHA256 3d581deeefd8d83c9005a4e7610a50e7237f88f8859c9b65d8f107da8247d96d
MD5 25d5bfac91eec88b26e80d042672a359
SHA1 724156d49e7e9187fb5bede79714c2159cfebae0
SHA512 2c001211051da800cb56a284dc24de2351c80d72efc1c963ed60b0cc0d9651779fa0c46e53a3e34baddafc923347f0b15a570c507e42921fd77031850680b62d
SSDEEP 393216:tDMINRsrRE7MADbG3JW6mFZxd4n9rLy+wO2zldnUV9dsq+5e:bsrRCDisFZw9rNZ2nn2s
TLSH
T1FA27331AEAA50431D4B3D0785BA39113FB36B841977142DF738D896E1F62AE0DB3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Txcizware-Loader (1).exe

File Explorer

Txcizware-Loader (1).exe

.exe 19.7MB

Txcizware-Loader (1).exe

IMPHASH ee1ebfb8a00edbb7244079b0406e89a0
SHA256 3d581deeefd8d83c9005a4e7610a50e7237f88f8859c9b65d8f107da8247d96d
MD5 25d5bfac91eec88b26e80d042672a359
SHA1 724156d49e7e9187fb5bede79714c2159cfebae0
SHA512 2c001211051da800cb56a284dc24de2351c80d72efc1c963ed60b0cc0d9651779fa0c46e53a3e34baddafc923347f0b15a570c507e42921fd77031850680b62d
SSDEEP 393216:tDMINRsrRE7MADbG3JW6mFZxd4n9rLy+wO2zldnUV9dsq+5e:bsrRCDisFZw9rNZ2nn2s
TLSH
T1FA27331AEAA50431D4B3D0785BA39113FB36B841977142DF738D896E1F62AE0DB3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

yoyo

Minor OS version

Major OS version

Entry point

278056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

ole32

CreateStreamOnHGlobal GetHGlobalFromStream StringFromGUID2 CoCreateGuid CoInitializeEx CoTaskMemFree CoUninitialize CoTaskMemAlloc

dwmapi

DwmSetWindowAttribute

crypt32

CryptProtectData CryptBinaryToStringA CryptUnprotectData

gdiplus

GdipAlloc GdipCreateBitmapFromHBITMAP GdiplusStartup GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipGetImageEncoders

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpConnect WinHttpSetOption WinHttpQueryHeaders WinHttpReadData WinHttpSetTimeouts

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptVerifySignature BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptImportKeyPair BCryptCreateHash

advapi32

EventUnregister RegGetValueW OpenProcessToken GetTokenInformation IsValidSid EventRegister EventSetInformation EventWriteTransfer RegOpenKeyExW GetSidSubAuthority GetSidSubAuthorityCount RegCloseKey RegQueryValueExW GetLengthSid

kernel32

AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetCommandLineW InitializeSListHead WaitForSingleObject MultiByteToWideChar Sleep GetLastError DeleteFileW CloseHandle GlobalLock LocalFree GetCurrentProcessId CreateProcessW GlobalUnlock MulDiv GetExitCodeProcess MoveFileExW CopyFileW GetTempFileNameW RemoveDirectoryW CreateMutexW CreateFileW GetFileAttributesW ReleaseMutex OpenProcess GetTickCount64 QueryFullProcessImageNameW SizeofResource LockResource LoadResource FindResourceW ReplaceFileW FreeLibrary LoadLibraryExW SetInformationJobObject QueryInformationJobObject GetConsoleScreenBufferInfo AssignProcessToJobObject TerminateProcess CreateJobObjectW ResumeThread IsProcessInJob CreateToolhelp32Snapshot ProcessIdToSessionId AttachConsole Process32NextW GetConsoleProcessList GetCurrentThread Process32FirstW FreeConsole WriteConsoleInputW GetConsoleWindow GetThreadTimes ReadConsoleOutputCharacterW TerminateJobObject GetProcessTimes ReadFile GetFileSizeEx WriteFile FlushFileBuffers FormatMessageW GetModuleHandleW GetCurrentProcess GetComputerNameExW GlobalSize WideCharToMultiByte OutputDebugStringA OutputDebugStringW GetProcAddress GetProcessHeap HeapFree LocalAlloc LoadLibraryW GetEnvironmentVariableW GetModuleFileNameW

user32

MapVirtualKeyW VkKeyScanW GetWindowThreadProcessId GetMessageW DefWindowProcW UnregisterHotKey PostMessageW SetProcessDpiAwarenessContext GetWindowRect DestroyWindow SetWindowPos MessageBoxW MonitorFromWindow SetWindowLongPtrW SetWindowRgn CreateWindowExW SendMessageW SetWindowTextW ReleaseDC RegisterClassExW ShowWindow IsWindow OpenClipboard DispatchMessageW SetTimer GetMonitorInfoW CloseClipboard RegisterHotKey TranslateMessage GetClipboardData LoadCursorW IsZoomed KillTimer PostQuitMessage SystemParametersInfoW UpdateWindow ReleaseCapture ShowWindowAsync GetSystemMetrics GetDC GetWindowLongPtrW GetClientRect GetDpiForWindow

gdi32

CreateCompatibleDC DeleteDC DeleteObject CreateCompatibleBitmap BitBlt GetStockObject SelectObject CreateRoundRectRgn

msvcp140

?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z _Query_perf_frequency ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ _Mtx_unlock _Mtx_lock ?eof@ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z _Thrd_detach ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ _Wcscoll ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception_context _CxxThrowException __current_exception __std_exception_destroy __std_exception_copy __std_terminate strchr _purecall memcpy memmove memcmp __C_specific_handler

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_beginthreadex abort terminate _errno _register_thread_local_exe_atexit_callback _invoke_watson _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol wcstoull wcstoul _wtoi

api-ms-win-crt-string-l1-1-0

towlower iswxdigit wcslen strlen towupper _wcsicmp iswspace

api-ms-win-crt-stdio-l1-1-0

fwrite fgetc __p__commode fclose fgetpos _set_fmode fflush fputc setvbuf ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vswprintf_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf