SONIC[.]EXE | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SONIC.EXE
Size 47.8MB
Sample261023-prwbeady9n
SHA256 c648e72f2d223792a076026f1532b2545b61bd19bbd3a18c22722b95bfae5cb8
MD5 c8aac36721c9a3ea8f6d6b538819380d
SHA1 4df0660796ee1b75a67cdd6b6c86a5218db85b61
SHA512 d020a2b7aaccad419a654da4578bc87c283de68945621d788655e5f8be4f144fa1a42b41d84c0948b35c61c4e63f9dbb5801ebb81dc8738408b3b40696cfbeb5
SSDEEP 786432:HEJkv9+LE71mOH45+SV8oidVQEUmZQny8z4hcUscFAdeL8ucyBIH5lAT/8LpLl6:Xv9+Lc31PdeFm+nyC4+UscF5j2AT/C
TLSH
T193B733162AD1397AE60427744D672B272B503C6D83B072FA6F3036BC05B34B79E2674E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SONIC.EXE

File Explorer

SONIC.EXE

.exe 47.8MB

SONIC.EXE

IMPHASH 6f25fb96b6fd81b4bb5d3c9f918e98b8
SHA256 c648e72f2d223792a076026f1532b2545b61bd19bbd3a18c22722b95bfae5cb8
MD5 c8aac36721c9a3ea8f6d6b538819380d
SHA1 4df0660796ee1b75a67cdd6b6c86a5218db85b61
SHA512 d020a2b7aaccad419a654da4578bc87c283de68945621d788655e5f8be4f144fa1a42b41d84c0948b35c61c4e63f9dbb5801ebb81dc8738408b3b40696cfbeb5
SSDEEP 786432:HEJkv9+LE71mOH45+SV8oidVQEUmZQny8z4hcUscFAdeL8ucyBIH5lAT/8LpLl6:Xv9+Lc31PdeFm+nyC4+UscF5j2AT/C
TLSH
T193B733162AD1397AE60427744D672B272B503C6D83B072FA6F3036BC05B34B79E2674E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA SetFilePointer FreeResource LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile SetCurrentDirectoryA GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime GlobalAlloc GetWindowsDirectoryA _lclose GlobalLock GetCurrentProcess FreeLibrary _llseek lstrcmpA Sleep InterlockedExchange InterlockedCompareExchange GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA ExpandEnvironmentStringsA

gdi32

GetDeviceCaps

user32

GetDC SendMessageA SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowRect GetSystemMetrics MessageBoxA GetWindowLongA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SetWindowLongA

msvcrt

_except_handler4_common _controlfp ?terminate@@YAXXZ _acmdln _initterm __setusermatherr _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter memcpy_s _vsnprintf memcpy memset

comctl32

ord17

cabinet

ord23 ord21 ord22 ord20

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA