smallcock[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
smallcock.exe
Size 313KB
Sample261027-efj4wsat4t
SHA256 e8ae1fdbbb935e7ad2df706544ca9ddb3297c8f6a1361efb293dfa54f265ff87
MD5 f9b9832e6615b577568a3b4e76b7b5f7
SHA1 fec2bd6783b8a1d4bf84f39f798df9c4f0e793c9
SHA512 ef5e93f3bbaf817c7cbc9492b58dff483ad8a6250479d67c657975e32b49fefd2c3cb41a8efcc613ece5c78ca772532bddc690ab2f30a3b1a6b004e6656b28f7
SSDEEP 1536:zPr7jC9H/q5wndWLWR7ggfy5azTlRXd33DxUsgrh34UYxB6jRVeazFoUBYyyF4:Djiyw8MgCy5mRNHDerh3hYxBOlzacL+
TLSH
T17F649639B26908B1D1B6C079E947835BCDA0305A533D60FFE1C6D9D8AB207ECAA7CD51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
smallcock.exe

File Explorer

smallcock.exe

.exe 313KB

smallcock.exe

IMPHASH 99b557a1d74f211dbceacf1349e6c090
SHA256 e8ae1fdbbb935e7ad2df706544ca9ddb3297c8f6a1361efb293dfa54f265ff87
MD5 f9b9832e6615b577568a3b4e76b7b5f7
SHA1 fec2bd6783b8a1d4bf84f39f798df9c4f0e793c9
SHA512 ef5e93f3bbaf817c7cbc9492b58dff483ad8a6250479d67c657975e32b49fefd2c3cb41a8efcc613ece5c78ca772532bddc690ab2f30a3b1a6b004e6656b28f7
SSDEEP 1536:zPr7jC9H/q5wndWLWR7ggfy5azTlRXd33DxUsgrh34UYxB6jRVeazFoUBYyyF4:Djiyw8MgCy5mRNHDerh3hYxBOlzacL+
TLSH
T17F649639B26908B1D1B6C079E947835BCDA0305A533D60FFE1C6D9D8AB207ECAA7CD51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97603

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\69800\Downloads\FiveM--main\FiveM-Spoofer-main\main\x64\Debug\smallcock.pdb

kernel32

GetPrivateProfileIntA WritePrivateProfileStringA VirtualQuery GetProcessHeap HeapFree HeapAlloc InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter TerminateProcess GetCurrentProcess RaiseException IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW GetProcAddress GetModuleHandleW DeviceIoControl GetLastError CloseHandle AreFileApisANSI GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree FreeLibrary

user32

SendMessageW

shell32

SHGetPathFromIDListA SHBrowseForFolderA

msvcp140d

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

vcruntime140d

memmove __std_exception_copy __std_exception_destroy _CxxThrowException memset memcmp __current_exception __current_exception_context __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s wcscpy_s _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll malloc _callnewh terminate abort ___lc_codepage_func _malloc_dbg _free_dbg __p__commode _lock_file ungetc setvbuf remove fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fclose _get_stream_buffer_pointers getenv strlen _CrtDbgReport _calloc_dbg system wcslen _invoke_watson strcpy_s _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_new_mode __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _unlock_file _crt_at_quick_exit _cexit fflush

Name

.textbss

Size

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

209KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

smallcock.exe

kernel32

user32

shell32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic