INV[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
INV.exe
Size 4.7MB
Sample261026-rf8hpsts2m
SHA256 9e7e6780270c88f32b4a9fcf0884020d046e8dfb0d39c2c351400c042d0a4f82
MD5 d1d7e9900c54b60e69f6389ae394606b
SHA1 1a167097cd407370c38a284b8f1589afad665b8b
SHA512 01086274ce9fce9c6e2e5a7746bedfbc4849fff142ea5ff0a5bcc176d95f16e2f68d5f4eb4f1217efc1ef33a75a9b6f3d5e4c2cb36be03e1e92235fedece89ee
SSDEEP 49152:bZpP7gV3Ij/r3ZK5kAImbiLIU7aDTqfGuB2csXlHK/bYy55ghvxggq9Qy052Yuwu:QX5kAIm8ODTqO0s1qTYaQvxxxqY1
TLSH
T108360217F3A582EDD42758348AA28B86F3737810171196CF33986659AF5B2F00EBB7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
INV.exe

File Explorer

INV.exe

.exe 4.7MB

INV.exe

IMPHASH 5213db6f142cefe02483b8d2dfb9033e
SHA256 9e7e6780270c88f32b4a9fcf0884020d046e8dfb0d39c2c351400c042d0a4f82
MD5 d1d7e9900c54b60e69f6389ae394606b
SHA1 1a167097cd407370c38a284b8f1589afad665b8b
SHA512 01086274ce9fce9c6e2e5a7746bedfbc4849fff142ea5ff0a5bcc176d95f16e2f68d5f4eb4f1217efc1ef33a75a9b6f3d5e4c2cb36be03e1e92235fedece89ee
SSDEEP 49152:bZpP7gV3Ij/r3ZK5kAImbiLIU7aDTqfGuB2csXlHK/bYy55ghvxggq9Qy052Yuwu:QX5kAIm8ODTqO0s1qTYaQvxxxqY1
TLSH
T108360217F3A582EDD42758348AA28B86F3737810171196CF33986659AF5B2F00EBB7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

649280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

OutputDebugStringA LocalFree FormatMessageW GetEnvironmentVariableW CreateFileW DeleteFileW WriteFile CloseHandle WaitForSingleObject Sleep CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindFirstFileW FindNextFileW TerminateProcess LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetTickCount64 GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree HeapAlloc GetStdHandle ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue QueryPerformanceFrequency QueryPerformanceCounter GetLastError LoadLibraryW GetProcAddress FlsGetValue FlsAlloc SetLastError GetModuleHandleW FreeLibrary SetStdHandle RtlUnwind HeapSize WriteConsoleW SetEndOfFile GetCurrentThreadId FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 MoveFileExW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx

user32

LoadCursorA SetProcessDPIAware ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsIconic ShowWindow WaitMessage GetMonitorInfoW MonitorFromPoint TranslateMessage SetWindowLongPtrW GetWindowLongPtrW GetCursorPos GetWindowRect SetWindowRgn GetSystemMetrics ReleaseCapture SetCapture GetCapture SetWindowPos SetLayeredWindowAttributes DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW MessageBoxW

gdi32

CreateRoundRectRgn DeleteObject

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

Name

.text

Size

837KB

Virtual Size

836KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

INV.exe

d3d11

kernel32

user32

gdi32

shell32

ole32

imm32

generic