ResSync[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ResSync.exe
Size 42.5MB
Sample261027-sd5vgavtfy
SHA256 1d3ebb8a7bbb8bc296034664ccd6232617a5b11091bef877e56807d3eff1e92b
MD5 23894cc96eedeb65c580fef56d895246
SHA1 0643702b0a71908bd94313f0d4a0a9c848bb39b0
SHA512 e79d161404d7650954021d518debaa311a4ae45c199c1ef004b59e87f52c84397ee915ccc588531fa57539dcef91ecaa1325035071d6fa742c1a662b0e0e4244
SSDEEP 393216:RnoopOhe7B3Zdp1uPGiSPWw1J/pfbO4lwQ9SmjMZzLTttAAAAKq4vNuzV:Rnooj7Vfp1uVS+w1SVMNqS8
TLSH
T142A7BE03F81119E6C76CC4F5C5AA065627B4FC542B2EABD31B50BB24ADE76C06E7B390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ResSync.exe

File Explorer

ResSync.exe

.exe 42.5MB

ResSync.exe

IMPHASH 26a2dbfc23d0419321dc24a4a75ddf90
SHA256 1d3ebb8a7bbb8bc296034664ccd6232617a5b11091bef877e56807d3eff1e92b
MD5 23894cc96eedeb65c580fef56d895246
SHA1 0643702b0a71908bd94313f0d4a0a9c848bb39b0
SHA512 e79d161404d7650954021d518debaa311a4ae45c199c1ef004b59e87f52c84397ee915ccc588531fa57539dcef91ecaa1325035071d6fa742c1a662b0e0e4244
SSDEEP 393216:RnoopOhe7B3Zdp1uPGiSPWw1J/pfbO4lwQ9SmjMZzLTttAAAAKq4vNuzV:Rnooj7Vfp1uVS+w1SVMNqS8
TLSH
T142A7BE03F81119E6C76CC4F5C5AA065627B4FC542B2EABD31B50BB24ADE76C06E7B390
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

ChoosePixelFormat CreateBitmap CreateDCW CreateDIBSection CreateRectRgn DeleteDC DeleteObject DescribePixelFormat GetDeviceCaps GetDeviceGammaRamp SetDeviceGammaRamp SetPixelFormat SwapBuffers

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadExecutionState SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue VerSetConditionMask VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

api-ms-win-crt-convert-l1-1-0

strtol strtoul

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr powf

api-ms-win-crt-private-l1-1-0

memcpy memmove strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler _wassert abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _write fflush fwrite setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strcpy strcspn strlen strncmp strncpy strspn strtok wcscmp wcscpy

api-ms-win-crt-utility-l1-1-0

qsort rand_s

opengl32

wglGetProcAddress

shell32

DragAcceptFiles DragFinish DragQueryFileW DragQueryPoint

user32

AdjustWindowRectEx BringWindowToTop ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CreateIconIndirect CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsExW EnumDisplaySettingsW FlashWindow GetActiveWindow GetClassLongPtrW GetClientRect GetClipboardData GetCursorPos GetDC GetKeyState GetLayeredWindowAttributes GetMessageTime GetMonitorInfoW GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetWindowLongW GetWindowPlacement GetWindowRect IsIconic IsWindowVisible IsZoomed LoadCursorW LoadImageW MapVirtualKeyW MonitorFromWindow MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageW PostMessageW PtInRect RegisterClassExW RegisterDeviceNotificationW RegisterRawInputDevices ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetRect SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnregisterClassW UnregisterDeviceNotification WaitMessage WindowFromPoint

Name

.text

Size

8.1MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

573B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/110

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/122

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/138

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/154

Size

876KB

Virtual Size

875KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ResSync.exe

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

opengl32

shell32

user32

generic