random[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
random.exe
Size 8.6MB
Sample261015-1bcd5sds91
SHA256 a9b390969f6c351f163a4ad67c9f5779eb4332157830f02a450d7b3f858528c4
MD5 be5d3238b82242e1d589895b90f26d91
SHA1 a1ead56cdc456fa1deec7aad72196654e05df239
SHA512 c563b7db60a03c1e73fe4565b580a0de3feded5a24ab9200831a916e8df26424a84cc1a4cf89d17d69c63e4e9e54d73e41ed3e747f72fa9558050a0fb56c3a20
SSDEEP 98304:dR+X7dmOkuP6Rwzdm3rNL8BtuBXaEWTQ83j/Rvl1:dR+XfBP6q0aBKaE+7z/Rvl1
TLSH
T17596BF17F7859269D02AC17CC2E78B26E632B4451B2262CF1244573D2E77BF82F3A794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
random.exe

File Explorer

random.exe

.exe 8.6MB

random.exe

IMPHASH 1d610436a5721c2299f27b07a5cc75a6
SHA256 a9b390969f6c351f163a4ad67c9f5779eb4332157830f02a450d7b3f858528c4
MD5 be5d3238b82242e1d589895b90f26d91
SHA1 a1ead56cdc456fa1deec7aad72196654e05df239
SHA512 c563b7db60a03c1e73fe4565b580a0de3feded5a24ab9200831a916e8df26424a84cc1a4cf89d17d69c63e4e9e54d73e41ed3e747f72fa9558050a0fb56c3a20
SSDEEP 98304:dR+X7dmOkuP6Rwzdm3rNL8BtuBXaEWTQ83j/Rvl1:dR+XfBP6q0aBKaE+7z/Rvl1
TLSH
T17596BF17F7859269D02AC17CC2E78B26E632B4451B2262CF1244573D2E77BF82F3A794
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

427744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\epala\Downloads\random\random\random\random\x64\Release\random.pdb

kernel32

OutputDebugStringA GetTempPathW GetEnvironmentVariableA GetVolumeInformationA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep CopyFileA GetLastError GetFileAttributesA Process32NextW MoveFileExA CreateFileA GetCurrentThread DeleteFileA Process32FirstW CloseHandle GetProcAddress ExitProcess ReadProcessMemory GetModuleHandleW WriteProcessMemory CreateProcessA CreateDirectoryA VirtualFreeEx GetTickCount QueryPerformanceFrequency InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryA GetModuleFileNameA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree WriteFile QueryPerformanceCounter FreeLibrary CreateRemoteThread GlobalAlloc VirtualAllocEx MultiByteToWideChar

user32

CreateWindowExW SetWindowLongPtrW SetWindowPos DestroyWindow GetWindowRect DefWindowProcW UnregisterClassW GetWindowLongPtrW PeekMessageW TranslateMessage PostQuitMessage GetDesktopWindow GetClassInfoExW UpdateWindow GetKeyState GetMessageExtraInfo RegisterClassExW DispatchMessageW ShowWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow

comdlg32

GetOpenFileNameA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteW ShellExecuteA

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

wininet

HttpQueryInfoA InternetOpenUrlA HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA InternetSetOptionA

msvcp140

_Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset __current_exception_context __current_exception memcmp memchr _CxxThrowException __std_exception_copy __std_terminate strstr strchr __std_exception_destroy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

fwrite _wfopen __stdio_common_vfprintf feof ungetc __stdio_common_vsprintf fread __stdio_common_vsscanf _set_fmode fputs fputc ferror _wfopen_s fseek fclose __p__commode fflush fgetc __acrt_iob_func ftell __stdio_common_vsprintf_s fopen_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free realloc malloc

api-ms-win-crt-convert-l1-1-0

_strtoi64 strtol

api-ms-win-crt-string-l1-1-0

strncpy strlen wcslen _wcsnicmp strncmp _stricmp strcpy_s isalnum tolower _wcsicmp strcmp

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

_cexit terminate _beginthreadex _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

sinf ldexp powf __setusermatherr fmodf ceilf expf acosf sqrtf cosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale