1guil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1guil.exe
Size 1.2MB
Sample261017-n4faaaew3p
SHA256 49a5b6740d175fb131138ab772a1f3757c5774cbc1d491ba8702c61c3ae6ff6d
MD5 1cc562dadc537d52237ddc4813ab99e8
SHA1 59412e3c32692a83d65a1783860ce48d33724ce8
SHA512 1aadf7adcd0bb71f3379f4832f127b765f97a5676a0c00773c13a4b07fb7a130def6a049cda6b88c7ab4bf97061b096b7757cdad56bf5c9c4fd9fb694cb179f4
SSDEEP 24576:5WrI/3lYB8LISmmcOxqwozg7uvuw5Rs9epoOGfCFLNbe0kJP2JP90uMJ:p/i8VmMxF6CgVEik4JP90uMJ
TLSH
T144459E42FB8381B1F5CA00B5106B6BF7AD362521872598D3E7C01DB599252D27B3FB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1guil.exe

File Explorer

1guil.exe

.exe 1.2MB

1guil.exe

IMPHASH 9f955c62d6009942fcf7a28b1b8aae75
SHA256 49a5b6740d175fb131138ab772a1f3757c5774cbc1d491ba8702c61c3ae6ff6d
MD5 1cc562dadc537d52237ddc4813ab99e8
SHA1 59412e3c32692a83d65a1783860ce48d33724ce8
SHA512 1aadf7adcd0bb71f3379f4832f127b765f97a5676a0c00773c13a4b07fb7a130def6a049cda6b88c7ab4bf97061b096b7757cdad56bf5c9c4fd9fb694cb179f4
SSDEEP 24576:5WrI/3lYB8LISmmcOxqwozg7uvuw5Rs9epoOGfCFLNbe0kJP2JP90uMJ:p/i8VmMxF6CgVEik4JP90uMJ
TLSH
T144459E42FB8381B1F5CA00B5106B6BF7AD362521872598D3E7C01DB599252D27B3FB8E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

940832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty

crypt32

CryptUnprotectData CryptStringToBinaryA

comctl32

ord17

user32

GetMessageA LoadIconA LoadCursorA MessageBoxA GetWindowRect GetClientRect UpdateWindow EnableWindow KillTimer SetTimer MoveWindow ShowWindow DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA SendMessageA DispatchMessageA TranslateMessage

gdi32

CreateFontA

kernel32

GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess GetCurrentProcess GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineA GetFullPathNameW GetEnvironmentVariableA GetTempPathA CloseHandle GetCurrentProcessId GetLocalTime LocalFree CreateToolhelp32Snapshot Process32First Process32Next FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile WriteConsoleW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetModuleHandleW CopyFile2 GetFileInformationByHandleEx InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread