Menu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Menu.exe
Size 12.7MB
Sample261015-v91xhade79
SHA256 76b32d4bd1bec035d121ed36458a3443cb68aaff8d0d9b47538000c6cbfc6610
MD5 fdb2b777d20564ae1e978e2f170056cd
SHA1 b64b6f33b12f6b2ea14ba0cfd348a30814a8457e
SHA512 5879557e592ec217e716ac9a5feea9e75430acc0419b97f6e43938a154cc4a9bfe1b5f1babf795ae72f373b397cec98cde39608d6bf1ed7fcb711b7a32341939
SSDEEP 196608:ChRJ5dBGQirWsiEB2YdGkgAscicCmLUinbRtGE8CNP3TQulvWM3hDP5p:CrJ5d0rM3Qic/LTnbRtGE5ucuMr
TLSH
T126D6121AE3DB6B6FDF53A0F9014071B39B677D71132D6AF7B285C036A6068C40AAC725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Menu.exe

File Explorer

Menu.exe

.exe 12.7MB

Menu.exe

IMPHASH 9cb542ce27151ff6cb0a46db5d6508ee
SHA256 76b32d4bd1bec035d121ed36458a3443cb68aaff8d0d9b47538000c6cbfc6610
MD5 fdb2b777d20564ae1e978e2f170056cd
SHA1 b64b6f33b12f6b2ea14ba0cfd348a30814a8457e
SHA512 5879557e592ec217e716ac9a5feea9e75430acc0419b97f6e43938a154cc4a9bfe1b5f1babf795ae72f373b397cec98cde39608d6bf1ed7fcb711b7a32341939
SSDEEP 196608:ChRJ5dBGQirWsiEB2YdGkgAscicCmLUinbRtGE8CNP3TQulvWM3hDP5p:CrJ5d0rM3Qic/LTnbRtGE5ucuMr
TLSH
T126D6121AE3DB6B6FDF53A0F9014071B39B677D71132D6AF7B285C036A6068C40AAC725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

470596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Xenon\Desktop\spoofer_dx11\bin\Menu.pdb

kernel32

K32GetModuleFileNameExW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetCurrentProcessId K32EnumProcessModules GetTempPathW WaitForSingleObject GetFileAttributesW SetFileAttributesW GetLastError DeleteFileW MoveFileExW CreateProcessW GlobalUnlock InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WideCharToMultiByte ExitProcess WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree TerminateProcess SleepConditionVariableSRW GetModuleFileNameW GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA RtlCaptureContext

user32

GetMessageExtraInfo EmptyClipboard ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor CloseClipboard GetClipboardData SetClipboardData GetClientRect MessageBoxA OpenClipboard UpdateWindow PostQuitMessage LoadCursorW LoadIconW TranslateMessage IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetLayeredWindowAttributes MoveWindow PeekMessageW SetWindowLongA GetKeyState

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership

shell32

ShellExecuteA ShellExecuteW ShellExecuteExW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantChangeType VariantClear

msvcp140

??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Thrd_sleep _Query_perf_counter _Thrd_detach _Xtime_get_ticks ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

iphlpapi

GetAdaptersInfo

wlanapi

WlanCloseHandle WlanFreeMemory WlanEnumInterfaces WlanOpenHandle

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memcpy memset _CxxThrowException memmove __C_specific_handler __current_exception_context memchr __current_exception strchr memcmp __std_exception_destroy strstr __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line _initterm _initterm_e _exit _configure_wide_argv _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _initialize_wide_environment _beginthreadex exit abort _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fclose ftell __stdio_common_vfprintf __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc __stdio_common_vfwprintf fputc fflush fseek __acrt_iob_func fwrite __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp towlower strncpy mblen

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

sinf sqrtf sin powf pow fmodf cosf cos roundf acosf __setusermatherr ceilf