eu07[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
eu07.exe
Size 4.2MB
Sample261024-nccebatxfw
SHA256 9878c1e77fd64d839c7bed9ba218bfc0e2f457a7ae31f8898ad74913b4a2c9f6
MD5 5090edd379405a0da98c62235b73e62b
SHA1 0cdfa272ba48cdddf87348d383f42ad2f91f5ba0
SHA512 45e0d2be8da3a4f061162bb6a3db12479be1e5c8a4695470f365c01504ae1426da32f1a44701357c78750ea03c0a72c1ece035757a79bd1410198fec5a30860e
SSDEEP 49152:VXLJYzL7La8pkegpMI5sSIpbR7mHdT1vaZqLri89DZcYSp3P1bas+PZZiXgWPMd:6rERygVtZoX16pRksuBbB
TLSH
T118168D16769841FCC1B7E13C964BAA43F676748687308AEB03D106681FBB7E05EBF611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eu07.exe

File Explorer

eu07.exe

.exe 4.2MB

eu07.exe

IMPHASH b29301bbc47c518656fda4bd09c59ccb
SHA256 9878c1e77fd64d839c7bed9ba218bfc0e2f457a7ae31f8898ad74913b4a2c9f6
MD5 5090edd379405a0da98c62235b73e62b
SHA1 0cdfa272ba48cdddf87348d383f42ad2f91f5ba0
SHA512 45e0d2be8da3a4f061162bb6a3db12479be1e5c8a4695470f365c01504ae1426da32f1a44701357c78750ea03c0a72c1ece035757a79bd1410198fec5a30860e
SSDEEP 49152:VXLJYzL7La8pkegpMI5sSIpbR7mHdT1vaZqLri89DZcYSp3P1bas+PZZiXgWPMd:6rERygVtZoX16pRksuBbB
TLSH
T118168D16769841FCC1B7E13C964BAA43F676748687308AEB03D106681FBB7E05EBF611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3020268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\projects\maszyna\build\x64\pdb\RelWithDebInfo\eu07-x64_2024-06-13.pdb

openvr_api

VR_InitInternal2 VR_GetGenericInterface VR_IsInterfaceVersionValid VR_ShutdownInternal VR_GetInitToken

python27

PySys_SetObject PyEval_ReleaseLock PyEval_AcquireLock PyEval_InitThreads PyEval_RestoreThread PyEval_SaveThread PyErr_Print PyObject_CallObject Py_Finalize Py_InitializeEx Py_SetPythonHome Py_BuildValue PyThreadState_Swap PyThreadState_Delete PyThreadState_Clear PyThreadState_New PyErr_NormalizeException PyErr_Fetch PyErr_Occurred PyDict_SetItemString PyDict_New PyList_SetItem PyList_New PyTuple_SetItem PyTuple_New PyString_AsString PyString_FromString PyFloat_FromDouble PyInt_AsLong PyInt_FromLong PyObject_GetAttrString PyObject_Str PyImport_ImportModule PyObject_CallMethod _Py_TrueStruct PyRun_SimpleStringFlags _Py_ZeroStruct

libpng16

png_image_begin_read_from_file png_image_finish_read png_image_write_to_file

openal32

alcIsExtensionPresent alcCloseDevice alcOpenDevice alcDestroyContext alcMakeContextCurrent alcCreateContext alDistanceModel alDopplerFactor alSourceUnqueueBuffers alSourceStop alSourcePlay alGetSourcei alSourcefv alSourcef alcGetProcAddress alGenSources alListenerfv alListenerf alIsExtensionPresent alBufferData alIsBuffer alDeleteBuffers alGenBuffers alGetError alGetString alGetBufferi alSourceQueueBuffers alSourceRewind alSourcei alcGetString alcGetIntegerv alGetProcAddress

lua51

lua_gettable luaL_openlibs luaL_newstate lua_close lua_atpanic lua_settop lua_tolstring lua_pushstring lua_pushcclosure luaL_loadfile lua_getfield lua_setfield lua_pcall luaL_loadstring

libserialport-0

sp_set_config sp_get_port_by_name sp_drain sp_flush sp_output_waiting sp_free_port sp_list_ports sp_free_port_list sp_open sp_close sp_input_waiting sp_new_config sp_free_config sp_get_port_name sp_set_config_baudrate sp_set_config_bits sp_set_config_parity sp_set_config_stopbits sp_set_config_flowcontrol sp_blocking_read sp_blocking_write

ws2_32

WSARecv WSAIoctl WSAGetLastError WSASetLastError setsockopt select ntohl listen htons htonl getsockopt getsockname ioctlsocket closesocket bind accept __WSAFDIsSet getaddrinfo WSACleanup WSAStartup socket shutdown send connect WSAStringToAddressW WSASocketW WSASend

glfw3

glfwSetWindowUserPointer glfwGetWindowUserPointer glfwGetCurrentContext glfwJoystickPresent glfwSetCharCallback glfwSetKeyCallback glfwSetCursorPos glfwPollEvents glfwSetFramebufferSizeCallback glfwSetWindowFocusCallback glfwSetWindowSizeCallback glfwFocusWindow glfwGetFramebufferSize glfwGetWindowSize glfwSetWindowTitle glfwSetWindowShouldClose glfwWindowShouldClose glfwDestroyWindow glfwCreateWindow glfwWindowHint glfwSetMouseButtonCallback glfwGetVideoMode glfwSetCursorPosCallback glfwSetScrollCallback glfwGetMonitorName glfwGetMonitorPos glfwGetPrimaryMonitor glfwGetMonitors glfwGetVersion glfwGetClipboardString glfwInitHint glfwTerminate glfwInit glfwGetWin32Window glfwGetJoystickName glfwGetJoystickButtons glfwGetJoystickAxes glfwSetInputMode glfwGetKey glfwSetClipboardString glfwGetWindowAttrib glfwDestroyCursor glfwMakeContextCurrent glfwCreateStandardCursor glfwSwapBuffers glfwSwapInterval glfwGetProcAddress glfwGetCursorPos glfwGetMouseButton glfwGetTime glfwGetKeyName glfwGetInputMode glfwSetCursor

libsndfile-1

ord2 ord1 ord3 ord19

kernel32

IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent WideCharToMultiByte GetModuleHandleW GetCurrentThreadId AreFileApisANSI GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindClose CreateFileW GetCurrentDirectoryW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead TlsAlloc TerminateThread QueueUserAPC WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW SleepEx WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError GetLastError CloseHandle VerSetConditionMask AllocConsole DeleteFileA WriteConsoleA SetConsoleTextAttribute GetLocalTime GetStdHandle CreateDirectoryA GetTickCount QueryPerformanceFrequency QueryPerformanceCounter TlsSetValue TlsFree LocalFree FormatMessageA VerifyVersionInfoA MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GlobalFree ReadFile WriteFile SetHandleInformation CreatePipe CreateProcessA GetProcAddress LoadLibraryA CreateFileA TlsGetValue

user32

MapVirtualKeyA keybd_event GetKeyState CallWindowProcA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrA SetWindowPos SendMessageA FindWindowA SystemParametersInfoA

msvcp140

?id@?$ctype@D@std@@2V0locale@2@A ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setf@ios_base@std@@QEAAHHH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ _Mtx_destroy_in_situ _Mtx_init_in_situ _Query_perf_frequency _Query_perf_counter ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unsetf@ios_base@std@@QEAAXH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xbad_alloc@std@@YAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??Bios_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPEADK@Z ?setf@ios_base@std@@QEAAHH@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Random_device@std@@YAIXZ _Xtime_get_ticks _Thrd_sleep _Cnd_init_in_situ _Cnd_destroy_in_situ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_start _Thrd_detach _Mtx_init _Mtx_destroy _Mtx_lock _Mtx_unlock _Cnd_init _Cnd_destroy _Cnd_wait _Cnd_signal _Cnd_do_broadcast_at_thread_exit ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z _Thrd_join _Thrd_id ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Mtx_current_owns _Cnd_timedwait _Cnd_broadcast ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

mswsock

GetAcceptExSockaddrs AcceptEx

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

vcruntime140

__std_terminate memcpy __std_exception_destroy _CxxThrowException __CxxFrameHandler3 memchr memcmp memmove memset __RTtypeid __std_type_info_compare _purecall __RTDynamicCast strchr __C_specific_handler strstr __std_exception_copy

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc realloc

api-ms-win-crt-runtime-l1-1-0

terminate exit _initterm_e _c_exit _register_thread_local_exe_atexit_callback _initterm _errno system _Exit _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit __p___argv __p___argc _seh_filter_exe _invalid_parameter_noinfo_noreturn _set_app_type _get_initial_narrow_environment _exit

api-ms-win-crt-math-l1-1-0

atan2 sinf sin roundf sqrt hypot fmodf _hypotf sqrtf ceil log2 round cosf modff ldexp lrintf ceilf atan2f tanf powf expf acosf logf tan pow log fmod lround exp floorf _fdtest _dtest asin atan acos __setusermatherr cos floor lrint

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf ungetc __stdio_common_vsscanf ftell __p__commode setvbuf fwrite _fseeki64 ferror feof fopen_s fsetpos __stdio_common_vfprintf __acrt_iob_func __stdio_common_vsprintf_s _wfopen _set_fmode fseek _get_stream_buffer_pointers fclose fflush fgetc fgetpos fputc fread

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atoi atof strtol strtof strtoul strtod

api-ms-win-crt-string-l1-1-0

tolower toupper isdigit strcmp strcpy_s strncpy strncmp

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

generic

count=10, id=260, version=26706,

count=3, id=259, version=26706,

count=37, id=261, version=26706,

count=4, id=257, version=26706,

count=2, id=147, productName=VS2008 build 21022, version=21022,

count=2, id=257, version=27034,

count=12, id=257, version=23917,

count=4, id=257, version=25019,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=257, productName=VS2017 v15.7.5 build 26433, version=26433,

count=591, id=1, productName=Unmarked objects,

count=3, id=260, version=27035,

count=155, id=261, version=27035,

count=1, id=256, version=27035,

count=1, id=255, version=27035,

count=1, id=151,

count=1, id=258, version=27035,