testing53[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
testing53.exe
Size 1.9MB
Sample261014-ph7cbacy6t
SHA256 23bce521eb0bc740f9a10f1aa511e9ab2757b33e1aeff6c795cbe3fdb1d9b788
MD5 f1b1d1fbfe29b564b91904498fb3fcd7
SHA1 3aabaf84e84da398c9f3924acaa84c0a4e84b3dd
SHA512 70119b97371b2998dba9ea55d0eeae55c1dd2e7f1858ede3b77f683a5fb7d5c084e562ba78e94af1bcc7fcce4215770fbabbb73a24e31dbb224b1ba68d590a1e
SSDEEP 49152:TGkvQ+vikPF2cugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Sx:TG86Xxo3
TLSH
T17995C0BE72583398C02AC9389523BD07F275781A076446DF37DABAD02F9B1D49A35B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
testing53.exe

File Explorer

testing53.exe

.exe 1.9MB

testing53.exe

IMPHASH 5369c7b2c2b878a922f92f74cd89b5c7
SHA256 23bce521eb0bc740f9a10f1aa511e9ab2757b33e1aeff6c795cbe3fdb1d9b788
MD5 f1b1d1fbfe29b564b91904498fb3fcd7
SHA1 3aabaf84e84da398c9f3924acaa84c0a4e84b3dd
SHA512 70119b97371b2998dba9ea55d0eeae55c1dd2e7f1858ede3b77f683a5fb7d5c084e562ba78e94af1bcc7fcce4215770fbabbb73a24e31dbb224b1ba68d590a1e
SSDEEP 49152:TGkvQ+vikPF2cugq1NTxoPCdIA1sITLl3oKJ6mEO2l3Sx:TG86Xxo3
TLSH
T17995C0BE72583398C02AC9389523BD07F275781A076446DF37DABAD02F9B1D49A35B43
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

485656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

AllocateAndInitializeSid SetTokenInformation SetThreadToken CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW GetTokenInformation RevertToSelf RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetEntriesInAclW PrivilegeCheck OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter AreFileApisANSI FormatMessageA GetLocaleInfoEx GetFileAttributesExW FindNextFileW FindFirstFileExW WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory FindClose GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread Module32FirstW Module32NextW ExitProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW WakeAllConditionVariable CreateProcessW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive UnhandledExceptionFilter FindFirstFileW Sleep SleepConditionVariableSRW

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW GetWindowRect SetForegroundWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture GetWindowLongW TranslateMessage SetWindowLongW SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW PeekMessageW

shell32

SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

shlwapi

PathStripPathW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset __std_exception_destroy __std_exception_copy strchr strstr memcmp memchr memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fwrite fgetpos __stdio_common_vsscanf _wfopen setvbuf ungetc __stdio_common_vfprintf fseek _set_fmode __acrt_iob_func ftell fsetpos fread __p__commode fgetc _fseeki64 fflush __stdio_common_vsprintf fclose _get_stream_buffer_pointers fputc

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcscpy_s tolower _wcsicmp towlower strcpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson terminate _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _beginthreadex _set_app_type _seh_filter_exe _cexit exit _crt_atexit _register_thread_local_exe_atexit_callback abort _wsystem _initialize_onexit_table _register_onexit_function

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sqrtf acosf __setusermatherr sqrt fmodf logf cosf ceilf pow powf sinf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale