harakiri (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
harakiri (1).exe
Size 2.7MB
Sample261023-apavcsbh28
SHA256 4e32c5d0330a414a1eacc2dc8f88e80a39b7bb3600b8de75f1af86c87a91e955
MD5 e528a8d2322c0b9eb6ec406dc4505baa
SHA1 5b5697380635ab88b98e63a141b6002797259d95
SHA512 00db80487ca42aee5e0ec4bfa40cc9ce96f3bc9064522dd3e04e3cd167a6c7e7e114e562320389c0e0b834683f4d3e870a11fdfce829e5384ae9e80aad157c57
SSDEEP 49152:OlTQo2eY1V97UNuVUD+UC1EpX53r526t8MQbGWJ3q9m4r7b6l6EcwUzfXjxnYifc:GAiDYMmgzqY8
TLSH
T110D57C3ABA5410B8D066D5B8CA9735D3EF7638090F798AF3DED061158F671E05A3EE08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
harakiri (1).exe

File Explorer

harakiri (1).exe

.exe 2.7MB

harakiri (1).exe

IMPHASH 8fe465857d84efa0aa9376a1c54e847b
SHA256 4e32c5d0330a414a1eacc2dc8f88e80a39b7bb3600b8de75f1af86c87a91e955
MD5 e528a8d2322c0b9eb6ec406dc4505baa
SHA1 5b5697380635ab88b98e63a141b6002797259d95
SHA512 00db80487ca42aee5e0ec4bfa40cc9ce96f3bc9064522dd3e04e3cd167a6c7e7e114e562320389c0e0b834683f4d3e870a11fdfce829e5384ae9e80aad157c57
SSDEEP 49152:OlTQo2eY1V97UNuVUD+UC1EpX53r526t8MQbGWJ3q9m4r7b6l6EcwUzfXjxnYifc:GAiDYMmgzqY8
TLSH
T110D57C3ABA5410B8D066D5B8CA9735D3EF7638090F798AF3DED061158F671E05A3EE08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1803888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled DwmExtendFrameIntoClientArea DwmSetWindowAttribute

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptCreateHash

ole32

CreateStreamOnHGlobal CoInitializeEx CoCreateInstance CoUninitialize

kernel32

GetCurrentProcess GetModuleHandleExW OutputDebugStringA TerminateProcess GetModuleFileNameW GetProcessId K32GetModuleFileNameExW SetThreadPriority GetEnvironmentVariableW GetTempPathW GetVolumePathNameW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetModuleHandleA K32EnumProcessModulesEx OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError GetFileAttributesExW Process32NextW K32GetModuleBaseNameW GetCurrentThread WaitForSingleObjectEx LockResource GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetNativeSystemInfo K32GetModuleInformation LoadResource FindResourceW GetLocalTime SwitchToThread GetWindowsDirectoryW Beep AreFileApisANSI GlobalLock LocalFree ReadProcessMemory GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx GetModuleHandleW WideCharToMultiByte QueryFullProcessImageNameW SetLastError GlobalUnlock IsWow64Process GetProcessTimes VirtualQueryEx SetUnhandledExceptionFilter GetExitCodeProcess GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime WriteProcessMemory GetCurrentDirectoryW CompareFileTime GetVolumeInformationW SizeofResource lstrcmpiW InitializeSListHead GetProcAddress

user32

GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout IsWindowUnicode SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW UnregisterHotKey PostMessageW MapVirtualKeyW GetWindow GetWindowRect DestroyWindow GetDC IsWindowVisible BeginPaint EqualRect MessageBoxW MonitorFromWindow SetWindowLongPtrW SetWindowRgn FillRect CreateWindowExW UnionRect ScreenToClient GetSystemMetrics UnregisterClassW SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow ReleaseDC GetKeyNameTextA GetAsyncKeyState GetCapture DispatchMessageW GetMonitorInfoW ClientToScreen PeekMessageW SetWindowDisplayAffinity MapVirtualKeyA SetWindowPos IsIconic GetAncestor LoadImageW SetForegroundWindow RegisterHotKey GetForegroundWindow EnumWindows IsRectEmpty SetLayeredWindowAttributes IntersectRect BringWindowToTop TranslateMessage LoadCursorW SetCapture SetCursor SetRectEmpty GetClientRect UpdateLayeredWindow GetKeyNameTextW PostQuitMessage EnumDisplaySettingsW SystemParametersInfoW UpdateWindow ReleaseCapture EndPaint

gdi32

GetStockObject CreateDIBSection CreateRectRgn DeleteDC DeleteObject CreateRoundRectRgn CreateCompatibleDC SelectObject CombineRgn

advapi32

GetTokenInformation RegCreateKeyExW RegSetValueExW OpenProcessToken RegOpenKeyExW RegGetValueW RegDeleteValueW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z _Mtx_trylock _Cnd_signal _Thrd_hardware_concurrency _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

gdiplus

GdipDisposeImage GdipBitmapSetPixel GdipSetSmoothingMode GdipFlush GdipSetClipPath GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipSetInterpolationMode GdipDrawImagePoints GdipCreateSolidFill GdipSetStringFormatTrimming GdipCreateRegion GdipFillPath GdipGraphicsClear GdipSetPenDashStyle GdipCloneBitmapAreaI GdipDrawLine GdipDrawRectangle GdipIsVisibleRect GdipDisposeImageAttributes GdipSetPixelOffsetMode GdipFillRectangle GdipSetSolidFillColor GdipSetClipRectI GdipAlloc GdipCreateBitmapFromStream GdipClosePathFigure GdipDeleteBrush GdipGetSmoothingMode GdipCreateImageAttributes GdipGetGenericFontFamilySansSerif GdipFree GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetPenLineJoin GdipFillEllipse GdipSetPenEndCap GdipGetClip GdipCloneStringFormat GdipSetTextRenderingHint GdipStringFormatGetGenericTypographic GdipDrawEllipse GdipRestoreGraphics GdipMeasureString GdipDeleteRegion GdipGetImageGraphicsContext GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipSetCompositingMode GdipDeleteFont GdipStartPathFigure GdipGetImageWidth GdipTranslateWorldTransform GdipDeletePen GdipCreateBitmapFromScan0 GdipSetPathFillMode GdipCreatePen1 GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipDeletePrivateFontCollection GdipPrivateAddMemoryFont GdipSetStringFormatFlags GdipSetPenStartCap GdipCloneImage GdipDrawImageRect GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipAddPathPolygon GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetImageHeight GdipDeleteFontFamily GdipCreateStringFormat GdipGetInterpolationMode GdipAddPathLine GdiplusShutdown GdipDeletePath GdiplusStartup GdipGetStringFormatFlags

winmm

timeEndPeriod timeBeginPeriod

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memmove memcpy memcmp memchr __std_terminate wcschr __std_exception_copy __std_exception_destroy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

fseek fputc ftell __stdio_common_vswprintf_s _wfsopen _get_stream_buffer_pointers _wfopen _fseeki64 fflush __stdio_common_vsscanf _wfopen_s fclose fread fsetpos ungetc __stdio_common_vsprintf_s fgetc __stdio_common_vfprintf _ftelli64 _set_fmode fwrite __stdio_common_vswprintf __stdio_common_vsprintf __p__commode fgetpos fputs setvbuf __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-string-l1-1-0

strcmp tolower strncmp _wcsicmp towlower wcsncpy_s strncpy wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _invoke_watson

api-ms-win-crt-math-l1-1-0

expf acosf sqrtf sqrt sinf cosf roundf _hypotf _fdclass _dclass floor cos atan2 round sin hypot ceilf powf fmodf fmod remainderf floorf __setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale