xcode-ide[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xcode-ide.exe
Size 5.8MB
Sample261026-v2gtnaft91
SHA256 c9a2301a03193a1f573e8cc74336ec3c21b4a64c83ab10be81786ddb54e541e1
MD5 c43f504187a0fc0a103f3304e7d6b0fb
SHA1 a87f2ed7439f439bf602bae52326716180d5f378
SHA512 8a1d0e37b7bb9ee1fabe83791a2d2df891d4cd38ee42dfbd74ca4f1bb5a0ad756877281000f9e878b702f2f6a8a3952bd7e3020591bd2e8a2af56f3cbe5e32dc
SSDEEP 98304:792SUx9QMZ+fc1xREXscbbkqjedMT/PHZGuMUwyux0cilOJ/G4q05+OmSQKKzr/G:79o0fc1xREXscbbkEedMT/PHZGuMUwyZ
TLSH
T166566D27628502ECE0BAC17D8F5A9D52EB72740A03B16BEF0AD055A64E675F04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xcode-ide.exe

File Explorer

xcode-ide.exe

.exe 5.8MB

xcode-ide.exe

IMPHASH f6e7247f2c68cefe15dbdde85acb788d
SHA256 c9a2301a03193a1f573e8cc74336ec3c21b4a64c83ab10be81786ddb54e541e1
MD5 c43f504187a0fc0a103f3304e7d6b0fb
SHA1 a87f2ed7439f439bf602bae52326716180d5f378
SHA512 8a1d0e37b7bb9ee1fabe83791a2d2df891d4cd38ee42dfbd74ca4f1bb5a0ad756877281000f9e878b702f2f6a8a3952bd7e3020591bd2e8a2af56f3cbe5e32dc
SSDEEP 98304:792SUx9QMZ+fc1xREXscbbkqjedMT/PHZGuMUwyux0cilOJ/G4q05+OmSQKKzr/G:79o0fc1xREXscbbkEedMT/PHZGuMUwyZ
TLSH
T166566D27628502ECE0BAC17D8F5A9D52EB72740A03B16BEF0AD055A64E675F04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4247588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\odenj\OneDrive\Desktop\Xcode\ide\build\symbols\xcode-ide.pdb

user32

PeekMessageW LoadKeyboardLayoutW ToUnicodeEx UnloadKeyboardLayout GetKeyboardLayoutList DefWindowProcW PostQuitMessage SetWindowPos SetFocus GetFocus GetKeyboardState SetKeyboardState DispatchMessageW SetTimer TranslateMessage GetClassNameW EnumWindows RemovePropW GetPropW SetPropW AllowSetForegroundWindow SendMessageTimeoutW IsWindow SendMessageW SetForegroundWindow IsIconic MapVirtualKeyW KillTimer GetMonitorInfoW MonitorFromRect SystemParametersInfoW LoadIconW LoadCursorW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetCursorPos SetCursor SetWindowTextW ValidateRect SetMenuDefaultItem TrackPopupMenu EnableMenuItem GetSystemMenu GetSystemMetrics ReleaseCapture SetCapture GetCapture GetKeyState IsZoomed SetWindowPlacement GetWindowPlacement FlashWindowEx GetDoubleClickTime GetMessageTime TrackMouseEvent MapVirtualKeyExW GetKeyboardLayout MapWindowPoints EnumClipboardFormats MonitorFromWindow CreateIconIndirect LoadImageW DestroyIcon ReleaseDC GetDC GetCaretBlinkTime EmptyClipboard SetClipboardData IsClipboardFormatAvailable GetWindowThreadProcessId RegisterClipboardFormatW GetClipboardData CloseClipboard OpenClipboard MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW RegisterClassExW PostMessageW GetDpiForWindow MonitorFromPoint ClientToScreen GetWindowRect GetClientRect EndMenu GetSystemMetricsForDpi ShowWindow

shell32

SHGetKnownFolderPath ord155 ord190 SHOpenFolderAndSelectItems SHCreateItemFromParsingName DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles SHAppBarMessage CommandLineToArgvW ShellExecuteExW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

ole32

CoTaskMemFree CoUninitialize OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CreateStreamOnHGlobal GetHGlobalFromStream

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

advapi32

GetAce GetSecurityDescriptorControl GetSecurityInfo SetSecurityInfo OpenProcessToken

windowscodecs

WICConvertBitmapSource

oleaut32

VariantInit

d2d1

ord2 ord1 ord12

dwrite

DWriteCreateFactory

gdi32

SetEnhMetaFileBits GetEnhMetaFileBits DeleteEnhMetaFile CreateDIBSection DeleteObject CreateBitmap

d3d11

D3D11CreateDevice

imm32

ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionFontW ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

winmm

timeBeginPeriod timeEndPeriod

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

shlwapi

StrCmpLogicalW

kernel32

VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetModuleHandleExW FreeLibraryAndExitThread ExitThread FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetDateFormatW InitializeCriticalSectionEx GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetNativeSystemInfo TryAcquireSRWLockExclusive ReadDirectoryChangesW SetThreadDescription ResetEvent CancelIoEx GetOverlappedResult GetSystemTimeAsFileTime CopyFileW GetSystemTimePreciseAsFileTime GetLocaleInfoEx GetFileInformationByHandleEx SetFileInformationByHandle SetEndOfFile GetFinalPathNameByHandleW GetFileInformationByHandle GetDriveTypeW WideCharToMultiByte MultiByteToWideChar RegisterWaitForSingleObject UnregisterWaitEx CancelSynchronousIo TerminateJobObject GetExitCodeProcess PeekNamedPipe SearchPathW SetProcessInformation GlobalFree GetCurrentDirectoryW GlobalSize GetTickCount GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetThreadId GetCurrentThread WaitForMultipleObjects CreateEventW SetEvent GetFileAttributesExW FindNextChangeNotification FindFirstChangeNotificationW EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP FindCloseChangeNotification CompareFileTime GetCommandLineA SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize GlobalLock CompareStringOrdinal SetInformationJobObject AssignProcessToJobObject CreateJobObjectW UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList ResumeThread GetFullPathNameW GetProcessTimes GetCurrentProcess CloseHandle GetLastError CreateProcessW GetModuleFileNameW DeleteFileW GetTickCount64 CreateMutexW Sleep GetCommandLineW LocalFree GetStdHandle CreateFileW FlushFileBuffers WriteFile GlobalAlloc GlobalUnlock RtlUnwind AttachConsole GetConsoleMode WriteConsoleW SetUnhandledExceptionFilter WaitForSingleObject GetCurrentProcessId ExitProcess TerminateProcess CreateThread GetCurrentThreadId GetLocalTime GetProcAddress LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetModuleHandleW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW MoveFileExW LCMapStringEx IsDebuggerPresent OutputDebugStringW FormatMessageW GetEnvironmentVariableW GetTempPathW GetEnvironmentStringsW FreeEnvironmentStringsW DuplicateHandle CreatePipe

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

811KB

Virtual Size

810KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

253KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xcode-ide.exe

user32

shell32

api-ms-win-shcore-scaling-l1-1-1

ole32

userenv

advapi32

windowscodecs

oleaut32

d2d1

dwrite

gdi32

d3d11

imm32

winmm

dwmapi

shlwapi

kernel32

generic