09[.]exe | Triage™

General

Target
09.exe
Size 445KB
Sample261016-1vphtaes21
SHA256 d6440c750c4f7d39a1dad4038bf022019c9da5f36e52637e23b27a85b2165468
MD5 a23326c8f28085bb52b5764f04a00030
SHA1 5062533379aa4b82062b1db242978bb35e690c52
SHA512 994b9ea05f9e364f2cfc6a2989986a967fc59e56f41dad30d6bc4c908727edfe0e99c51d5a597ba727ec9fa7cbc8a0dd5c2b64c3e932c4884763a5b068e93b29
SSDEEP 6144:cOJgAQopAkS2xLMJa7ztFMuSONQVJ9XaGPDHUCCOTD4jBpNsSWw3rzVS5rqkVPbv:I6cg0w3VsqkVfu4cpzzdc
TLSH
T104A47C46A7B510FAE1A3803AC9064502EAB37C55436DE9EB13D8CB711E679D0AF3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09.exe

File Explorer

09.exe

.exe 445KB

09.exe

IMPHASH 0e80296eb32f4fb025ef3b97637f3621
SHA256 d6440c750c4f7d39a1dad4038bf022019c9da5f36e52637e23b27a85b2165468
MD5 a23326c8f28085bb52b5764f04a00030
SHA1 5062533379aa4b82062b1db242978bb35e690c52
SHA512 994b9ea05f9e364f2cfc6a2989986a967fc59e56f41dad30d6bc4c908727edfe0e99c51d5a597ba727ec9fa7cbc8a0dd5c2b64c3e932c4884763a5b068e93b29
SSDEEP 6144:cOJgAQopAkS2xLMJa7ztFMuSONQVJ9XaGPDHUCCOTD4jBpNsSWw3rzVS5rqkVPbv:I6cg0w3VsqkVfu4cpzzdc
TLSH
T104A47C46A7B510FAE1A3803AC9064502EAB37C55436DE9EB13D8CB711E679D0AF3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

177376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile GetOEMCP GetModuleFileNameW CreateFileW OpenProcess Sleep GetLastError CloseHandle GetThreadContext WideCharToMultiByte SetThreadContext GetComputerNameA GetExitCodeProcess WriteConsoleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetStdHandle WriteFile HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile RtlUnwind

Name

.text

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

09.exe

kernel32

generic