test_bot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
test_bot.exe
Size 468KB
Sample261023-skte1sdb44
SHA256 27970d80c182ab7fef001266d78cd18bc269011bb62c6dc626787aba4ddaa162
MD5 a01ba5bdc0222f1830ddad1425454550
SHA1 04b7fd8e33a89311ace17fc5d65f2c9a0498d2fa
SHA512 8a86f044e2d610984cf8dbea553d8f97dd6ec33a79dc7ca1f96d0091ceb7de855e64125f822b6585ac590492865c1392594794212991a21cdc49dd7c69e20b62
SSDEEP 6144:lsv8RHLw/4NOf9zb1vOK4Oa5c6EvwymP7SidTiwaSKLoUcUe7f698j8HsJP5L5V6:s8RHLwou/1GYPmPNiwaSKL/e7wD
TLSH
T165A44927E7A387B9C097C174DE829271B535F8884134B26F1B85CE113F1AB609F6FA94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
test_bot.exe

File Explorer

test_bot.exe

.exe 468KB

test_bot.exe

IMPHASH 9b90a186c640d66db5fee1b0781cb791
SHA256 27970d80c182ab7fef001266d78cd18bc269011bb62c6dc626787aba4ddaa162
MD5 a01ba5bdc0222f1830ddad1425454550
SHA1 04b7fd8e33a89311ace17fc5d65f2c9a0498d2fa
SHA512 8a86f044e2d610984cf8dbea553d8f97dd6ec33a79dc7ca1f96d0091ceb7de855e64125f822b6585ac590492865c1392594794212991a21cdc49dd7c69e20b62
SSDEEP 6144:lsv8RHLw/4NOf9zb1vOK4Oa5c6EvwymP7SidTiwaSKLoUcUe7f698j8HsJP5L5V6:s8RHLwou/1GYPmPNiwaSKL/e7wD
TLSH
T165A44927E7A387B9C097C174DE829271B535F8884134B26F1B85CE113F1AB609F6FA94
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation GetUserNameA LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteTreeA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection DeleteDC DeleteObject GdiFlush GetDIBits GetDeviceCaps GetObjectA GetStockObject SelectObject SetBrushOrgEx SetStretchBltMode StretchBlt

gdiplus

GdipAlloc GdipCloneBitmapArea GdipCloneImage GdipCreateBitmapFromScan0 GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipLoadImageFromFile GdipSaveImageToFile GdipSaveImageToStream GdiplusShutdown GdiplusStartup

kernel32

AddVectoredExceptionHandler CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileTime GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MoveFileW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA PeekNamedPipe Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFilePointer SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

_wtoi atoi mbrtowc mbsrtowcs strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _fileno _get_osfhandle _read _setmode _wfopen fclose fflush fputc fread fseek ftell fwrite getc setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp isdigit isspace isxdigit mbrlen memset strcmp strcpy strlen strncmp strncpy strnlen tolower towlower wcscmp wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

ole32

CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal PropVariantClear

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

IsUserAnAdmin SHAppBarMessage SHCreateDirectoryExA SHCreateDirectoryExW SHGetFileInfoA SHGetFolderPathA ShellExecuteA ShellExecuteExA ShellExecuteW

user32

ChildWindowFromPoint CloseClipboard DestroyIcon DestroyWindow DrawIconEx EmptyClipboard EnumDisplayMonitors EnumWindows ExitWindowsEx FillRect GetClassNameA GetClipboardData GetCursorInfo GetDC GetDesktopWindow GetForegroundWindow GetMonitorInfoA GetParent GetSystemMetrics GetWindowLongA GetWindowRect GetWindowTextA GetWindowThreadProcessId IntersectRect IsHungAppWindow IsIconic IsWindow IsWindowVisible IsZoomed MoveWindow OpenClipboard PostMessageA PostMessageW PtInRect ReleaseDC ScreenToClient SendInput SendMessageA SendMessageTimeoutA SetClipboardData SetForegroundWindow SystemParametersInfoW keybd_event mouse_event

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

winmm

PlaySoundW mciSendStringW timeBeginPeriod

Name

.text

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

test_bot.exe

advapi32

avicap32

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

shell32

user32

winhttp

winmm

generic