map[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
map.exe
Size 464KB
Sample261027-2ns34axtax
SHA256 4dce8073ec58469512b8bbd83fa5a7a4e149672082cb1b377f65527a7ebaa57e
MD5 ad22d253d1901c7aa7767525bb0138f7
SHA1 1197790ebd9a514842f8ef550a1cc1c531481b66
SHA512 fd67c2ff179166e3b6bfae684ac41d3ffe74c750d9d795f4e0528e0ca9d848607cce364cb41020f10de34a5f42e567b11d781fc31d7ef5891408af14540f2777
SSDEEP 6144:9RU0Irj2UDZwV6xQJoIonTYVmOOOz84Gc381x6oJ2u1gBnIyMzGQvRgA3wtRCpAU:VaQJoImItOH63cp1gF1AAto2CWx/4z
TLSH
T1D5A45A1A939405BCF1A7D2788E928942FB76780A07B1DADF039494B24E677D05E3EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
map.exe

File Explorer

map.exe

.exe 464KB

map.exe

IMPHASH b55a909ce974dc18e967b4830fb6047f
SHA256 4dce8073ec58469512b8bbd83fa5a7a4e149672082cb1b377f65527a7ebaa57e
MD5 ad22d253d1901c7aa7767525bb0138f7
SHA1 1197790ebd9a514842f8ef550a1cc1c531481b66
SHA512 fd67c2ff179166e3b6bfae684ac41d3ffe74c750d9d795f4e0528e0ca9d848607cce364cb41020f10de34a5f42e567b11d781fc31d7ef5891408af14540f2777
SSDEEP 6144:9RU0Irj2UDZwV6xQJoIonTYVmOOOz84Gc381x6oJ2u1gBnIyMzGQvRgA3wtRCpAU:VaQJoImItOH63cp1gF1AAto2CWx/4z
TLSH
T1D5A45A1A939405BCF1A7D2788E928942FB76780A07B1DADF039494B24E677D05E3EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rx.pdb

shell32

ShellExecuteExW

advapi32

QueryServiceStatus RegDeleteTreeW OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW RegGetValueW CloseServiceHandle OpenSCManagerW OpenServiceW RegOpenKeyW GetUserNameW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyW RegSetKeyValueW

user32

ExitWindowsEx EnumDisplayDevicesW GetClassNameW EnumWindows GetWindowTextW GetWindowThreadProcessId GetShellWindow MessageBoxW ShowWindow

kernel32

ReadConsoleW HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetTempPathW WriteConsoleW DeviceIoControl WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress WideCharToMultiByte SetConsoleTitleW GetConsoleWindow GetConsoleProcessList CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadResource LockResource SizeofResource FindResourceW IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThread OpenThread GetThreadContext GetSystemInfo GetSystemDirectoryW GetSystemFirmwareTable GetComputerNameW Thread32First Thread32Next K32EnumProcessModules K32GetModuleBaseNameW GetStdHandle SetHandleInformation CreatePipe LoadLibraryW RtlUnwind GetCurrentThreadId CopyFileW GetEnvironmentStringsW CloseHandle GetLastError MultiByteToWideChar GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DuplicateHandle ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

Name

.text

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

map.exe

shell32

advapi32

user32

kernel32

iphlpapi

wintrust

generic