unseen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unseen.exe
Size 56KB
Sample261027-mghlfstsbs
SHA256 12eec13c2380d4e9d3dc92fe2ebae6d5d38fbd2d2d3ea7e1e0264fb6efa8e2a1
MD5 397e4c49d7e208e44f9d71cd3671277f
SHA1 704ed6d994b17817708c9d73c54e757447a82b08
SHA512 49c3d942ed325f868923567000b987e62cd37a6acb79d9a6592a5048e6dfe1f4b7d1226b0d6aaf119476f10465a555c7ddec4b5b9f807f4beecc1ce71dc3c88e
SSDEEP 1536:nAPl8jynyobKViVXDVW476gR7AB8fAy2POAFmKOo:2l86yEKVoVPfZXAi/KO
TLSH
T16F43092ACD1A506FD35A9C79CA534C02DF22FC8687A1A5CF67805CE60D759D8EF3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unseen.exe

File Explorer

unseen.exe

.exe 56KB

unseen.exe

IMPHASH 270ca7bec25dc6f8a6c23950694263a0
SHA256 12eec13c2380d4e9d3dc92fe2ebae6d5d38fbd2d2d3ea7e1e0264fb6efa8e2a1
MD5 397e4c49d7e208e44f9d71cd3671277f
SHA1 704ed6d994b17817708c9d73c54e757447a82b08
SHA512 49c3d942ed325f868923567000b987e62cd37a6acb79d9a6592a5048e6dfe1f4b7d1226b0d6aaf119476f10465a555c7ddec4b5b9f807f4beecc1ce71dc3c88e
SSDEEP 1536:nAPl8jynyobKViVXDVW476gR7AB8fAy2POAFmKOo:2l86yEKVoVPfZXAi/KO
TLSH
T16F43092ACD1A506FD35A9C79CA534C02DF22FC8687A1A5CF67805CE60D759D8EF3E602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\x7marka7bk\Downloads\unseen\x64\Release\unseen.pdb

kernel32

GetConsoleScreenBufferInfo SetConsoleTitleA GetStdHandle SetConsoleMode GetModuleFileNameW WaitForSingleObject GetFileAttributesW GetConsoleMode GetFileAttributesA CreateFileA CloseHandle WideCharToMultiByte CreateProcessA SetConsoleOutputCP GetExitCodeProcess Sleep GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Mtx_unlock _Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Thrd_hardware_concurrency ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

gdiplus

GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipBitmapUnlockBits GdiplusStartup GdipDisposeImage GdipFree GdipBitmapLockBits GdipGetImageWidth GdipCreateBitmapFromFile GdipAlloc

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memcpy memmove memset __std_terminate __current_exception_context __C_specific_handler _CxxThrowException __std_exception_destroy __current_exception __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __p__commode fwrite __stdio_common_vfprintf fflush _set_fmode __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _beginthreadex _initialize_narrow_environment _get_initial_narrow_environment _initterm system exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e terminate _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

tolower strlen wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale