hack[.]exe | Triage™

General

Target
hack.exe
Size 170KB
Sample261023-1d2rtags9n
SHA256 082d6ca4d70807c10d999561e27af171d3074ea76932752348c33de6e0aca851
MD5 3c5d8b91292de879bd5073c96aa19760
SHA1 b6b16e8c1459c9b8851f71a9c02fa41e0aa93a5a
SHA512 09839461136016d3fea7c979b7cc3d19d3b5db6badd908ce151f9d1fee82dfd6aa0a1948d3ba1fb1c6ac10d3f92982a3e01bcf94646aafee5e233054904b24cf
SSDEEP 3072:Ser/xKtvPiYsL1RiK+WLUJoZ9w8Q1ObLDIZTGPBJ8Mxrx:+niR3ZJ9A1OHXj8M
TLSH
T1F8047B4AB3A910F9D1B7C138C9921606FB7278250370ABDF47A447769F236E49D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hack.exe

File Explorer

hack.exe

.exe 170KB

hack.exe

IMPHASH 679e4abca2eb550c7c0ec57fb85497df
SHA256 082d6ca4d70807c10d999561e27af171d3074ea76932752348c33de6e0aca851
MD5 3c5d8b91292de879bd5073c96aa19760
SHA1 b6b16e8c1459c9b8851f71a9c02fa41e0aa93a5a
SHA512 09839461136016d3fea7c979b7cc3d19d3b5db6badd908ce151f9d1fee82dfd6aa0a1948d3ba1fb1c6ac10d3f92982a3e01bcf94646aafee5e233054904b24cf
SSDEEP 3072:Ser/xKtvPiYsL1RiK+WLUJoZ9w8Q1ObLDIZTGPBJ8Mxrx:+niR3ZJ9A1OHXj8M
TLSH
T1F8047B4AB3A910F9D1B7C138C9921606FB7278250370ABDF47A447769F236E49D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject Rectangle SelectObject SetBkMode SetTextColor TextOutW

user32

FillRect ReleaseDC GetDC GetAsyncKeyState DefWindowProcW ShowWindow DestroyWindow CreateWindowExW RegisterClassExW SetLayeredWindowAttributes

kernel32

WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers CloseHandle OpenProcess ReadProcessMemory GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

hack.exe

gdi32

user32

kernel32

generic