mgMpfulC45[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mgMpfulC45.exe
Size 13.4MB
Sample261027-nfc51sdv7p
SHA256 250b3a8299b1fc2e63a97cb34a0364e4536deadd549d56a92e397a20c1e669fe
MD5 0868f9d121f68c8e6335047ee4325b24
SHA1 02ac70360c32bb43a7e32aa38b2e112bf9a5338a
SHA512 73256993cc2eac7a7bef1a01392025021db4147797b316858784f4dca289f6a7a7086acee0fb348ac9630c0a66b743ec3385a5f17a31d7dfb05ce46952e5130f
SSDEEP 393216:3Nn0bq0RJsESy/4JwEjfn3aroX+OkfX+:dn0pZ5LETn9X+OkfX
TLSH
T13EE63351F2B443F8F07BA278E492252BCA327811173059CF6BD1095E4F73AE45A73BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mgMpfulC45.exe

File Explorer

mgMpfulC45.exe

.exe 13.4MB

mgMpfulC45.exe

IMPHASH 62ef94a0a489e668728275c1bfa9f993
SHA256 250b3a8299b1fc2e63a97cb34a0364e4536deadd549d56a92e397a20c1e669fe
MD5 0868f9d121f68c8e6335047ee4325b24
SHA1 02ac70360c32bb43a7e32aa38b2e112bf9a5338a
SHA512 73256993cc2eac7a7bef1a01392025021db4147797b316858784f4dca289f6a7a7086acee0fb348ac9630c0a66b743ec3385a5f17a31d7dfb05ce46952e5130f
SSDEEP 393216:3Nn0bq0RJsESy/4JwEjfn3aroX+OkfX+:dn0pZ5LETn9X+OkfX
TLSH
T13EE63351F2B443F8F07BA278E492252BCA327811173059CF6BD1095E4F73AE45A73BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

489952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable

ole32

CoCreateInstance CoInitializeEx

advapi32

GetTokenInformation GetUserNameA OpenProcessToken

user32

TranslateMessage SetProcessDPIAware ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetWindowThreadProcessId GetClassNameA EnumWindows SetWindowLongPtrA GetWindowLongPtrA SetProcessDpiAwarenessContext LoadCursorA ScreenToClient MessageBoxW SetWindowTextW ReleaseDC GetDC UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW

gdi32

GetDeviceCaps

shell32

ShellExecuteExA ShellExecuteA ShellExecuteW

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation GetFileSizeEx GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP OutputDebugStringW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess IsProcessorFeaturePresent WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStringTypeW GetModuleFileNameW CloseHandle QueryPerformanceCounter GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetTickCount64 GetModuleFileNameA MoveFileExW GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next GetLocalTime GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FlushFileBuffers ReadFile SetFileAttributesA WriteFile IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError WaitForSingleObject Sleep TerminateProcess CreateProcessA FindClose FindFirstFileA GlobalAlloc GlobalUnlock GlobalLock GlobalFree OutputDebugStringA WideCharToMultiByte VerSetConditionMask QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead CreateFileW HeapSize HeapReAlloc SetEndOfFile GetOEMCP FindNextFileA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

645KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mgMpfulC45.exe

d3d11

dwmapi

winhttp

ole32

advapi32

user32

gdi32

shell32

kernel32

imm32

d3dcompiler_47

generic