payload[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
payload.exe
Size 1.1MB
Sample261027-swkl9adh55
SHA256 d2d080aee4267d9c3b367c07c900c2ff2d6adb339e2d8862efc52ff954808214
MD5 ebd0121690e3f45a67d42ae4f0463bc3
SHA1 eb73755cb9a0731782a582257ee91f77d77d8816
SHA512 41c802be6a29d91769753ce31e4f99a7c179333597f1b40ee3724ad901242ad7100d754e21177b649f86363245d96bb7df28c4a4c1bdb1697760f1c928e7458e
SSDEEP 24576:j1d8Hs10fYVqFPZLW0GhGnys90DSxmvPByeVCA7C3N2wIo8Dc3:P8FfBLb6DO0D97C3N21Q
TLSH
T13C359E96FBC260B2E6C601F101ABABF69E362510D711D8C7D3802DA59D312D27B3FA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payload.exe

File Explorer

payload.exe

.exe 1.1MB

payload.exe

IMPHASH a722d4454af8a32e0db4c6af5972c218
SHA256 d2d080aee4267d9c3b367c07c900c2ff2d6adb339e2d8862efc52ff954808214
MD5 ebd0121690e3f45a67d42ae4f0463bc3
SHA1 eb73755cb9a0731782a582257ee91f77d77d8816
SHA512 41c802be6a29d91769753ce31e4f99a7c179333597f1b40ee3724ad901242ad7100d754e21177b649f86363245d96bb7df28c4a4c1bdb1697760f1c928e7458e
SSDEEP 24576:j1d8Hs10fYVqFPZLW0GhGnys90DSxmvPByeVCA7C3N2wIo8Dc3:P8FfBLb6DO0D97C3N21Q
TLSH
T13C359E96FBC260B2E6C601F101ABABF69E362510D711D8C7D3802DA59D312D27B3FA5D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

860288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetDC ReleaseDC InvalidateRect GetClientRect FillRect GetDesktopWindow SetWindowsHookExA CallNextHookEx SendInput ToUnicodeEx GetKeyboardState ShowWindow SwapMouseButton DispatchMessageA TranslateMessage GetKeyboardLayout GetMessageA DrawTextA

ole32

CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpConnect

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptSetProperty

gdi32

SetBkMode DeleteObject CreateSolidBrush SetTextColor

crypt32

CryptStringToBinaryA CryptUnprotectData

d3d11

D3D11CreateDevice

mfplat

MFStartup MFShutdown MFCreateMediaType MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFCreateDeviceSource

kernel32

FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW FindNextFileW UnhandledExceptionFilter TerminateProcess ExitProcess GetCurrentProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwind GetModuleHandleW GetStartupInfoW GetCommandLineA GetCommandLineW GetEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW SetStdHandle LoadLibraryW SetUnhandledExceptionFilter InitializeSListHead IsProcessorFeaturePresent GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable ExpandEnvironmentStringsA DeleteFileA DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileAttributesA ReadFile IsDebuggerPresent CloseHandle SetHandleInformation CreatePipe WaitForSingleObject GetCurrentProcessId CreateProcessW GlobalMemoryStatusEx GetSystemInfo VirtualProtect GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA LocalFree CopyFileA GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow FlushFileBuffers GetDriveTypeW QueryPerformanceCounter MapViewOfFile CreateFileMappingW GetSystemTimeAsFileTime FreeLibrary GetProcessHeap LockFileEx SetFilePointerEx HeapDestroy HeapCompact HeapAlloc WriteConsoleW HeapReAlloc WaitForSingleObjectEx FlushViewOfFile GetFileAttributesExW GetLastError GetTickCount64 FormatMessageW Sleep HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW GetTempPathW UnlockFileEx SetEndOfFile OutputDebugStringA WriteFile GetFullPathNameW HeapFree HeapCreate GetFileSizeEx AreFileApisANSI RaiseException GetOverlappedResult InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetExitCodeThread InitializeCriticalSectionEx