Hw[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Hw.exe
Size 23KB
Sample261017-rywxmafd75
SHA256 e89eab89847e5ce41dc8093765cd36e4edb2272e070365b7f214566c953bd9e1
MD5 b4e630aa6aba8d06535a1c412c6f93ac
SHA1 5f024b20720bd51db6f752e0e1647a8c9dfc161f
SHA512 a3622433fcafb79156ff29eaacfd339d8f673a364596f631107032aae940771e17d0975775c7a7f0d2bd17219cdc964ed3dd394d7bc8c6256c59d113601f2864
SSDEEP 384:b9wXkTGzkRD8YowxRECPbimKuA1Jp9uFs5J:yRYRYMLpimK/Jp9As3
TLSH
T1F1B2194A374DC88AD166D27D85F2976AE3717848B73263CF57E5425A2E122C0B43FD83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hw.exe

File Explorer

Hw.exe

.exe 23KB

Hw.exe

IMPHASH 47d13ad285fc4b755b04b012e4bd14a0
SHA256 e89eab89847e5ce41dc8093765cd36e4edb2272e070365b7f214566c953bd9e1
MD5 b4e630aa6aba8d06535a1c412c6f93ac
SHA1 5f024b20720bd51db6f752e0e1647a8c9dfc161f
SHA512 a3622433fcafb79156ff29eaacfd339d8f673a364596f631107032aae940771e17d0975775c7a7f0d2bd17219cdc964ed3dd394d7bc8c6256c59d113601f2864
SSDEEP 384:b9wXkTGzkRD8YowxRECPbimKuA1Jp9uFs5J:yRYRYMLpimK/Jp9As3
TLSH
T1F1B2194A374DC88AD166D27D85F2976AE3717848B73263CF57E5425A2E122C0B43FD83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Hw\x64\Release\Hw.pdb

msvcp140

?good@ios_base@std@@QEBA_NXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception __std_terminate __std_exception_copy __std_exception_destroy memset __C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function __p___argv _crt_atexit terminate exit _exit _initterm _c_exit _cexit _initterm_e _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe _get_initial_narrow_environment _invalid_parameter_noinfo_noreturn system

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

RtlCaptureContext GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCurrentThreadId