Base[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Base.exe
Size 848KB
Sample261017-ae4ppas1at
SHA256 ba5f51b71fb26ee37c7e06184e5fcded9bd57fee2ee49ecda154fc5ab842ed81
MD5 56d55da8ab5580ffa30e831ca0fcd546
SHA1 80353b4425e0b0cc0e994d08195daa7bb118ad4a
SHA512 58f471db86fb623fcef6779dfe271da1beddbbb7df4b29dc971ab302b1cf7e96e143eecb08d01004b32e185d94fa24020a54ec9474f180d79e55a6fc9743fe17
SSDEEP 12288:USbPbXcGDXqwBr+z+MdLsYj5G5xsMgFoiW5oZAKzE2Wii5nYosu2T:PbPTcGbqWKaMaYj45xLPL5gz3Xi5nYZ
TLSH
T10405BF55B2B811F9D03B9139C686B60BEA7534161B204ADB13E446AD3FB37E05BBF312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Base.exe

File Explorer

Base.exe

.exe 848KB

Base.exe

IMPHASH 6809ffa410f449d15c7f979c59dcfa22
SHA256 ba5f51b71fb26ee37c7e06184e5fcded9bd57fee2ee49ecda154fc5ab842ed81
MD5 56d55da8ab5580ffa30e831ca0fcd546
SHA1 80353b4425e0b0cc0e994d08195daa7bb118ad4a
SHA512 58f471db86fb623fcef6779dfe271da1beddbbb7df4b29dc971ab302b1cf7e96e143eecb08d01004b32e185d94fa24020a54ec9474f180d79e55a6fc9743fe17
SSDEEP 12288:USbPbXcGDXqwBr+z+MdLsYj5G5xsMgFoiW5oZAKzE2Wii5nYosu2T:PbPTcGbqWKaMaYj45xLPL5gz3Xi5nYZ
TLSH
T10405BF55B2B811F9D03B9139C686B60BEA7534161B204ADB13E446AD3FB37E05BBF312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

463788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Testowanko\Desktop\ImGui-External-Base-main\x64\Release\Base.pdb

kernel32

GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter Module32Next OpenProcess CreateToolhelp32Snapshot CloseHandle VirtualQueryEx SetEndOfFile HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GlobalAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread MultiByteToWideChar OutputDebugStringA K32GetModuleBaseNameA GetTickCount CreateThread RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetLastError ReadProcessMemory VirtualProtectEx Sleep AllocConsole WriteProcessMemory GetFileSizeEx SetConsoleTitleA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException WriteConsoleW

user32

EmptyClipboard CloseClipboard MessageBoxA GetClipboardData SetClipboardData OpenClipboard GetWindowThreadProcessId DispatchMessageA DestroyWindow SetWindowPos ShowWindow IsWindow GetAsyncKeyState SetWindowLongA GetWindowLongA SetWindowDisplayAffinity DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA PostQuitMessage FindWindowA RegisterClassExA UpdateWindow SetForegroundWindow DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos

shell32

ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

637KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Base.exe

kernel32

user32

shell32

d3d11

dwmapi

imm32

d3dcompiler_47

generic