syscall_cleaner (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
syscall_cleaner (1).exe
Size 232KB
Sample261023-wk29psfv2k
SHA256 7fd400927f1a17377200d7340698c8c97895256d95198c7f6d85a7b98e7c5178
MD5 4fdb2f01c4e55dff32b12769665b9746
SHA1 b61690438a36fc4549576cde5ee56004032b4f60
SHA512 736f0c0d220faca494e89ea09c8c9f23744f6bf6a4e0ea6a8073be5b7fb138d83a04999ab6690bfcd83d93099f1fe08900636633281b68aa98d6d5874caf6f90
SSDEEP 6144:VyeTIJk4Y1juBtEIPPxqJA1F8SnniSdPbXKUD6EsBwh3RNSJ2Y:VMyjuvxqJATNP9LO
TLSH
T19734F81CBA940675E5B7D678C9A30402EA737C864739DAEF139144B60F27AD0FE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
syscall_cleaner (1).exe

File Explorer

syscall_cleaner (1).exe

.exe 232KB

syscall_cleaner (1).exe

IMPHASH 3cda44ff1341df26eb6ed88ea20c2cb5
SHA256 7fd400927f1a17377200d7340698c8c97895256d95198c7f6d85a7b98e7c5178
MD5 4fdb2f01c4e55dff32b12769665b9746
SHA1 b61690438a36fc4549576cde5ee56004032b4f60
SHA512 736f0c0d220faca494e89ea09c8c9f23744f6bf6a4e0ea6a8073be5b7fb138d83a04999ab6690bfcd83d93099f1fe08900636633281b68aa98d6d5874caf6f90
SSDEEP 6144:VyeTIJk4Y1juBtEIPPxqJA1F8SnniSdPbXKUD6EsBwh3RNSJ2Y:VMyjuvxqJATNP9LO
TLSH
T19734F81CBA940675E5B7D678C9A30402EA737C864739DAEF139144B60F27AD0FE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Desktop\eac_tracer_method\x64\Release\syscall_cleaner.pdb

kernel32

GetLocalTime WriteConsoleW LocalFree MoveFileExW CloseHandle WideCharToMultiByte QueryFullProcessImageNameW GetDriveTypeW GetExitCodeProcess GetCurrentDirectoryW Process32FirstW DeleteFileW ReadConsoleW Process32NextW GetLastError FormatMessageW GetConsoleMode Sleep CreateToolhelp32Snapshot GetLogicalDriveStringsW SetFileAttributesW OpenProcess GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW GetEnvironmentVariableW GetModuleFileNameW TerminateProcess DeviceIoControl WriteFile GetStdHandle GetCurrentProcess SetLastError CreateProcessW ReadFile InitializeSListHead GetSystemTimeAsFileTime FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 GetModuleHandleW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW DeleteService ControlService RegEnumKeyExW RegDeleteTreeW OpenProcessToken FreeSid EnumServicesStatusExW RegUnLoadKeyW RegLoadKeyW CheckTokenMembership RegOpenKeyExW QueryServiceConfigW RegDeleteValueW OpenServiceW QueryServiceStatusEx RegEnumValueW RegQueryValueExW

shell32

ShellExecuteExW

msvcp140

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException __current_exception __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf_s fclose fgetc _set_fmode fwrite fgetpos setvbuf ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers fputc fflush

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

iswalnum wcslen strlen towlower

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-runtime-l1-1-0

_exit abort _register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table __p___wargv _register_onexit_function _crt_atexit terminate _cexit _seh_filter_exe _set_app_type _configure_wide_argv __p___argc _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-math-l1-1-0

__setusermatherr