55ecc0f5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
55ecc0f5.exe
Size 1.3MB
Sample261024-s48daaax5s
SHA256 e0297ac77e15c0b60ff093223ebdb2891af51022fbd3af5f86c47d571295d318
MD5 37fe1c4a9973f4f1525192757e0df76d
SHA1 5808da1ea24f786dc9e4217b0749d6ba7a867c0a
SHA512 7b9f8a7659677ac8127b86085f922213a29d5b5051ec5c75fc25f963b26888c552b42aac7a75bd044ebc36d8dccf5f4db3cdb3e9bdb050b115badeea754c6a4f
SSDEEP 24576:t5xNTQZUgRRrcfyFLh/LDqSGep9oAdU/8ZfiTnG30xs8nKvG1ZW:t5xNTyUgDcfWLh//qspav/hTnJs8QG1Y
TLSH
T1C755AE46F3B642ECC2678238C766931BEB75B81913204BCB63D05A56BF53AE19F79310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55ecc0f5.exe

File Explorer

55ecc0f5.exe

.exe 1.3MB

55ecc0f5.exe

IMPHASH afb7d0632435eae5ef0842de07b03502
SHA256 e0297ac77e15c0b60ff093223ebdb2891af51022fbd3af5f86c47d571295d318
MD5 37fe1c4a9973f4f1525192757e0df76d
SHA1 5808da1ea24f786dc9e4217b0749d6ba7a867c0a
SHA512 7b9f8a7659677ac8127b86085f922213a29d5b5051ec5c75fc25f963b26888c552b42aac7a75bd044ebc36d8dccf5f4db3cdb3e9bdb050b115badeea754c6a4f
SSDEEP 24576:t5xNTQZUgRRrcfyFLh/LDqSGep9oAdU/8ZfiTnG30xs8nKvG1ZW:t5xNTyUgDcfWLh//qspav/hTnJs8QG1Y
TLSH
T1C755AE46F3B642ECC2678238C766931BEB75B81913204BCB63D05A56BF53AE19F79310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

827776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shell32

ShellExecuteW

ws2_32

accept WSACleanup bind closesocket shutdown listen WSAStartup getsockname send socket ntohs recv htonl

kernel32

SleepConditionVariableSRW AcquireSRWLockExclusive GetCurrentThreadId SetUnhandledExceptionFilter GetStartupInfoW ReleaseSRWLockExclusive Sleep CreateDirectoryW GetVolumeInformationW GetModuleFileNameW GetEnvironmentVariableW GetFileAttributesW OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW LoadLibraryA Process32FirstW CloseHandle Module32FirstW GetProcAddress GetModuleHandleW GetCurrentProcessId Module32NextW SizeofResource MultiByteToWideChar LockResource LoadResource FindResourceW GetEnvironmentVariableA WaitForSingleObject UnmapViewOfFile CreateEventW GetExitCodeThread LoadLibraryW ReadProcessMemory CreateFileMappingW MapViewOfFile GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree CreateFileMappingA GetSystemTimeAsFileTime WakeAllConditionVariable InitializeSListHead WideCharToMultiByte

user32

ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard GetMessageExtraInfo CloseClipboard EmptyClipboard GetClipboardData GetKeyState GetWindowRect CreateWindowExW GetSystemMetrics RegisterClassExW MoveWindow SetLayeredWindowAttributes LoadIconW LoadCursorW DefWindowProcW DestroyWindow SetWindowLongPtrW GetWindowLongPtrW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetWindowThreadProcessId GetWindowTextLengthW PostMessageW IsWindowVisible EnumWindows SetClipboardData GetWindowTextW

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Cnd_broadcast ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __intrinsic_setjmp __C_specific_handler __std_exception_destroy memmove memcpy __std_exception_copy wcsstr memset __std_terminate strstr memcmp memchr strchr strrchr longjmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _fseeki64 _get_stream_buffer_pointers ftell fwrite fseek fgetc __stdio_common_vsprintf __stdio_common_vswprintf_s _wfopen __stdio_common_vsprintf_s fclose fgetpos __stdio_common_vfprintf fflush __acrt_iob_func _set_fmode fsetpos setvbuf __p__commode fputc ungetc fread

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen _wcsicmp strcpy strlen isalnum strcmp isdigit strncmp tolower strncpy

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _get_wide_winmain_command_line _beginthreadex _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initterm

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

_lrotl abs qsort

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free realloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoul

api-ms-win-crt-math-l1-1-0

sinf acosf sqrtf fabs cosf __setusermatherr ldexp roundf ceilf powf fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale