macro[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
macro.exe
Size 684KB
Sample261023-2jyg1set4x
SHA256 5d745b7d3d40bd5b2957705cac74a2782f149e6769184af7f4a6d9e2c31d030b
MD5 e3ca25c70c10cb4bdbe88ec49c6169ca
SHA1 830b10c1c09ae26735fedd51369f30577d645683
SHA512 b901752d7d64897f6d84dc3f73e67aa03dc211849f45cc2a1ea1597307634d0050a88ef5bcb4d18b65ca90f0b41bfb4d07c92c4ea8ba7bc7df1677db9c8153ad
SSDEEP 12288:8eguDvvKCkznfhG4B5GC0zg9viCnEobium4rLO4geR43:RDvS/nZG4B5isiCnEF4gC4
TLSH
T147E4AE44F2E404F8D077913A8A96AA1FE776381907205AEB23F4451A3FA77F49B7B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
macro.exe

File Explorer

macro.exe

.exe 684KB

macro.exe

IMPHASH 9f30db95d0ecfc5ae60ab8c3ba12a562
SHA256 5d745b7d3d40bd5b2957705cac74a2782f149e6769184af7f4a6d9e2c31d030b
MD5 e3ca25c70c10cb4bdbe88ec49c6169ca
SHA1 830b10c1c09ae26735fedd51369f30577d645683
SHA512 b901752d7d64897f6d84dc3f73e67aa03dc211849f45cc2a1ea1597307634d0050a88ef5bcb4d18b65ca90f0b41bfb4d07c92c4ea8ba7bc7df1677db9c8153ad
SSDEEP 12288:8eguDvvKCkznfhG4B5GC0zg9viCnEobium4rLO4geR43:RDvS/nZG4B5isiCnEF4gC4
TLSH
T147E4AE44F2E404F8D077913A8A96AA1FE776381907205AEB23F4451A3FA77F49B7B311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

GetCursorPos SetWindowLongW LoadIconW UpdateWindow AppendMenuW SetForegroundWindow GetForegroundWindow TranslateMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId IsWindowVisible DestroyMenu GetClassNameW GetWindowTextW ShowScrollBar GetSystemMetrics SetWindowLongA GetWindowLongA SetLayeredWindowAttributes MapVirtualKeyW GetKeyNameTextA GetAsyncKeyState MapVirtualKeyA SendInput GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow DispatchMessageW PeekMessageW PostQuitMessage

shell32

Shell_NotifyIconW ShellExecuteA

winmm

timeBeginPeriod timeEndPeriod

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx ReadConsoleW SetFilePointerEx GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile GetModuleFileNameW TerminateProcess GetCurrentProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread SetStdHandle GetStringTypeW CreateFileW HeapSize CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer Sleep GetModuleHandleW GetWindowsDirectoryA QueryPerformanceFrequency QueryPerformanceCounter FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetConsoleMode SetConsoleWindowInfo GetConsoleFontSize GetConsoleMode FreeConsole FillConsoleOutputAttribute GetConsoleWindow SetConsoleCursorPosition AllocConsole GetCurrentConsoleFont OpenProcess CloseHandle QueryFullProcessImageNameW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary HeapReAlloc WriteConsoleW SetEndOfFile ExitProcess FlsFree FlsSetValue FlsGetValue FlsAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError WaitForSingleObjectEx GetExitCodeThread RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

470KB

Virtual Size

470KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

macro.exe

d3d11

d3dcompiler_47

user32

shell32

winmm

kernel32

imm32

generic