wininit[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wininit.exe
Size 899KB
Sample261027-3gdkhav19k
SHA256 8b775dfd147e0d95ba2e9f73b8218dd288aafd4dbdf69961db66799f7433ac61
MD5 e7d6839cb338967f795939754899c08c
SHA1 25769430d28d74226569f878e876abb0e1dc1d16
SHA512 f8187c4d9f8ae2860b184dd5169ba586834aa64c7529cd34d240f4f5bb0c7cfa0b7f970cb83649efc55edc3c8a805e74f79d216782604d55e16f709c2006cb53
SSDEEP 24576:4xHO462BkfEKEdi6dNmSVr4gkGadC1lLfCvS+K9hEajHZlXiJnVYpb:QOhDgkLdC1lLxtlyJn
TLSH
T1F1159E1AA29902FCD4BBD179DA97990BEA71344D03314ADB13E04AA43F777E0477EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wininit.exe

File Explorer

wininit.exe

.exe 899KB

wininit.exe

IMPHASH c1ee8387a843dd912dd3c75eb46b27ab
SHA256 8b775dfd147e0d95ba2e9f73b8218dd288aafd4dbdf69961db66799f7433ac61
MD5 e7d6839cb338967f795939754899c08c
SHA1 25769430d28d74226569f878e876abb0e1dc1d16
SHA512 f8187c4d9f8ae2860b184dd5169ba586834aa64c7529cd34d240f4f5bb0c7cfa0b7f970cb83649efc55edc3c8a805e74f79d216782604d55e16f709c2006cb53
SSDEEP 24576:4xHO462BkfEKEdi6dNmSVr4gkGadC1lLfCvS+K9hEajHZlXiJnVYpb:QOhDgkLdC1lLxtlyJn
TLSH
T1F1159E1AA29902FCD4BBD179DA97990BEA71344D03314ADB13E04AA43F777E0477EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

709376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Aether.pdb

kernel32

WideCharToMultiByte GetConsoleWindow SetConsoleOutputCP K32EnumProcessModules AllocConsole SetConsoleTitleW GetCurrentProcess GetModuleFileNameW IsDebuggerPresent CheckRemoteDebuggerPresent GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter CreateToolhelp32Snapshot InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter OpenProcess RtlLookupFunctionEntry SetConsoleCP SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileW CreateFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA Process32FirstW Process32NextW GlobalMemoryStatusEx ReadProcessMemory LocalFree CloseHandle FreeConsole GetTickCount64 WaitForSingleObject FindClose FindNextFileA GetConsoleMode Sleep RtlCaptureContext MultiByteToWideChar K32GetModuleFileNameExW OutputDebugStringA SetConsoleMode GetStdHandle FindFirstFileA WriteProcessMemory RtlVirtualUnwind GetModuleFileNameA

user32

PostQuitMessage IsIconic UpdateWindow IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData GetCursorPos SetClipboardData DefWindowProcW PostMessageW MapVirtualKeyW SystemParametersInfoW SetProcessDpiAwarenessContext GetKeyState GetMessageExtraInfo EnumDisplayDevicesA DestroyWindow IsWindowVisible SetWindowPos MessageBoxW SetWindowLongPtrW CreateWindowExW ScreenToClient UnregisterClassW GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetWindowLongPtrW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW ClientToScreen SendInput PeekMessageW SetWindowDisplayAffinity GetForegroundWindow SetLayeredWindowAttributes TranslateMessage LoadIconW FindWindowW mouse_event GetClientRect GetKeyNameTextW

comdlg32

CommDlgExtendedError GetOpenFileNameW

advapi32

RegGetValueA RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetFolderPathW ShellExecuteW Shell_NotifyIconW

d3d11

D3D11CreateDeviceAndSwapChain

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??7ios_base@std@@QEBA_NXZ

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSetTimeouts WinHttpQueryDataAvailable

crypt32

CryptProtectMemory CryptUnprotectData CryptUnprotectMemory CryptProtectData

bcrypt

BCryptGetProperty BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy memmove _CxxThrowException wcsstr __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strchr __std_exception_copy __std_terminate

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vsscanf __stdio_common_vfprintf fseek ftell fflush _get_stream_buffer_pointers freopen_s _fseeki64 fread fclose ungetc setvbuf fgetpos __stdio_common_vsprintf fputc fwrite __p__commode _set_fmode __acrt_iob_func fgetc __stdio_common_vsprintf_s fsetpos

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-string-l1-1-0

isspace wcsncpy_s tolower strncpy strncmp toupper _wcsicmp strcpy_s strcmp wcscpy_s

api-ms-win-crt-math-l1-1-0

log fmodf cosf ceilf pow powf roundf logf acosf sinf _fdclass sqrtf _dclass _dsign __setusermatherr tanf

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _set_app_type _beginthreadex _errno _seh_filter_exe _cexit _initterm _invoke_watson _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort

api-ms-win-crt-convert-l1-1-0

strtoll strtod atoi strtoull atof

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

Name

.text

Size

707KB

Virtual Size

707KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aeth

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

884B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wininit.exe

kernel32

user32

comdlg32

advapi32

shell32

d3d11

msvcp140

dwmapi

winhttp

crypt32

bcrypt

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic