Cursed[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Cursed.exe
Size 4.7MB
Sample261024-efn3vaeb86
SHA256 6c21c5a5b9f8939d3468ff98fb4e86c17a0e230a2b9433835a503d392be97ca6
MD5 710d41d6504be65dc984d0458ec0710d
SHA1 a7a91ded0ec806632e54c8f5f3058a9883db8ff9
SHA512 97c06be8d6300b3e986074bc42e50d0c994bbb971d4eb122b383ffb4862d804fe5018a773cfde9fdffc452b401e02e8e3115b31d372744c08466964a5003cbd7
SSDEEP 49152:80gmXgB9GHYDpQTYh5jQXVLQXVrQXVUmj3aCBX+smh4jd4qblsmh4jd4qQFa:80gmXgB9SYv2+CUshNJshN
TLSH
T16936AF02F79BA1ADC05AC47483476A33BB31788E1B35AAE752D455393E66BE01F38F14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cursed.exe

File Explorer

Cursed.exe

.exe 4.7MB

Cursed.exe

IMPHASH 9544a16625681c6db25bd0555e06ba2c
SHA256 6c21c5a5b9f8939d3468ff98fb4e86c17a0e230a2b9433835a503d392be97ca6
MD5 710d41d6504be65dc984d0458ec0710d
SHA1 a7a91ded0ec806632e54c8f5f3058a9883db8ff9
SHA512 97c06be8d6300b3e986074bc42e50d0c994bbb971d4eb122b383ffb4862d804fe5018a773cfde9fdffc452b401e02e8e3115b31d372744c08466964a5003cbd7
SSDEEP 49152:80gmXgB9GHYDpQTYh5jQXVLQXVrQXVUmj3aCBX+smh4jd4qblsmh4jd4qQFa:80gmXgB9SYv2+CUshNJshN
TLSH
T16936AF02F79BA1ADC05AC47483476A33BB31788E1B35AAE752D455393E66BE01F38F14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2240852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cursed_loader.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetFilePointerEx GetProcessHeap HeapFree HeapReAlloc CloseHandle GetSystemTimePreciseAsFileTime FindClose ReadFile WriteFile GetCurrentProcessId CreateFileW LocalFree GetModuleHandleA GetProcAddress GetCurrentThread GetCurrentProcess TerminateProcess QueryPerformanceCounter GetLastError CreateMutexW GetModuleHandleW SwitchToThread GlobalAlloc GlobalLock GlobalUnlock GlobalMemoryStatusEx GetSystemFirmwareTable DeviceIoControl GetVolumeInformationW CreateEventW WaitForSingleObject GetProcessId GetExitCodeProcess CreateThread GetUserDefaultUILanguage CompareStringOrdinal SleepEx ReadFileEx WriteFileEx SetLastError GetFullPathNameW GetCurrentThreadId GetStdHandle DuplicateHandle CopyFileExW GetOverlappedResult SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WaitForMultipleObjects CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW lstrlenW MoveFileExW FindFirstFileExW ExitProcess WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW GetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW FlsSetValue IsThreadAFiber FormatMessageW QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo FindNextFileW LoadLibraryExA FreeLibrary LoadLibraryExW FlushFileBuffers HeapSize LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsGetValue GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime

crypt32

CertCreateCertificateChainEngine CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateChainEngine CertGetCertificateChain CertCloseStore CryptUnprotectData CertAddEncodedCertificateToStore CryptProtectData CertFreeCertificateContext

user32

SetWindowPos GetClientRect SetProcessDpiAwarenessContext TranslateMessage GetDpiForWindow DispatchMessageW CloseClipboard SetClipboardData PeekMessageW OpenClipboard DestroyWindow ReleaseDC ScreenToClient ShowWindow GetDC PostMessageW SetForegroundWindow RegisterClassW CreateWindowExW TrackMouseEvent EmptyClipboard SetCursor LoadCursorW SetCapture GetKeyState ReleaseCapture DefWindowProcW SendMessageW LoadIconW GetSystemMetrics MsgWaitForMultipleObjects GetClipboardData FindWindowW IsIconic IsWindowVisible

dwmapi

DwmEnableBlurBehindWindow

oleaut32

GetErrorInfo SysFreeString SysStringLen

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx

shell32

ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconW

winhttp

WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle WinHttpQueryOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpSetOption WinHttpOpen WinHttpConnect WinHttpOpenRequest

advapi32

RegGetValueW

opengl32

wglDeleteContext wglMakeCurrent wglCreateContext wglGetProcAddress

gdi32

CreateRectRgn DeleteObject ChoosePixelFormat SwapBuffers SetPixelFormat

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.notice

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Cursed.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

crypt32

user32

dwmapi

oleaut32

ole32

shell32

winhttp

advapi32

opengl32

gdi32

ntdll

generic