take2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
take2.exe
Size 401KB
Sample261024-rbpvssvtfx
SHA256 e927d999f460226520d40bb63c2a4dbf12c68ad8baeb85b10270e1751896a226
MD5 10f2d66a5d87a80c446e6e35a14d8ae2
SHA1 233674c57f6c6a3d7d8b4f2fb5a4b7021048d6aa
SHA512 bbbba5970732118f2fa5763b2a18dbb93c2989a4e88193c5bf05e968aa8b694c6ed18a8a3da95d8ad6c438a3023700151267b0837b78c7faa2920f32739dee40
SSDEEP 1536:SHqDZO7Obu55kNep+0Ze0fgZwRgg/JMbw3/uTh/y0qsmM4ZdyNNnttBQxLfPKgoq:SHq9O7ObPNghM42UyF55VtHoANQ
TLSH
T192949A44E9F9D38DED780670CB0386A148206D6FE61572B36AC87FB93A3FD125707296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
take2.exe

File Explorer

take2.exe

.exe 401KB

take2.exe

IMPHASH c296447493965716a3e30f60e2cd7fe4
SHA256 e927d999f460226520d40bb63c2a4dbf12c68ad8baeb85b10270e1751896a226
MD5 10f2d66a5d87a80c446e6e35a14d8ae2
SHA1 233674c57f6c6a3d7d8b4f2fb5a4b7021048d6aa
SHA512 bbbba5970732118f2fa5763b2a18dbb93c2989a4e88193c5bf05e968aa8b694c6ed18a8a3da95d8ad6c438a3023700151267b0837b78c7faa2920f32739dee40
SSDEEP 1536:SHqDZO7Obu55kNep+0Ze0fgZwRgg/JMbw3/uTh/y0qsmM4ZdyNNnttBQxLfPKgoq:SHq9O7ObPNghM42UyF55VtHoANQ
TLSH
T192949A44E9F9D38DED780670CB0386A148206D6FE61572B36AC87FB93A3FD125707296
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

love

luaopen_love love_codename ?luax_resume@love@@YAHPEAUlua_State@@HPEAH@Z love_version luaopen_love_jitsetup love_openConsole

lua51

lua_isnumber lua_type lua_tonumber lua_tolstring lua_pushstring lua_pushcclosure lua_pushboolean lua_getfield lua_pushvalue lua_settop lua_gettop lua_newthread lua_close lua_createtable lua_setfield lua_rawseti lua_call luaL_openlibs luaL_newstate

msvcp120

?_Winerror_map@std@@YAPEBDH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

_acmdln _initterm _initterm_e __setusermatherr _configthreadlocale _ismbblead _cexit _exit exit _fmode ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crtSetUnhandledExceptionFilter _commode _purecall ??2@YAPEAX_K@Z ??3@YAXPEAX@Z printf memmove _CxxThrowException __CxxFrameHandler3 memcpy strcmp _lock _unlock _calloc_crt __dllonexit __C_specific_handler _onexit _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type

shell32

CommandLineToArgvW

sdl2

SDL_memcpy SDL_free SDL_wcslen SDL_strlen SDL_iconv_string SDL_SetMainReady SDL_ShowSimpleMessageBox

kernel32

LocalFree GetProcessHeap HeapFree HeapAlloc GetCommandLineW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter DecodePointer EncodePointer