GK[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GK.exe
Size 534KB
Sample261027-xex88swthx
SHA256 ceca7da25b7af7d3545c553b8285145f19d687708811ca9a2155e5854d50f1f1
MD5 c40556fc12176275af207eb26de75f39
SHA1 b8eaa3d8951f9116401bf7d059a5ea8d4ee67e43
SHA512 7d332abaa93c89459756ef580367a9aef5ff7c905ae5f6a7688eb15cb8652515873e5acfe49ac7dbfbc499d7917546a291c0d029a3ec16e2a656fe4059171021
SSDEEP 6144:Y8J2TWRZ4IMquV3ojGy8UnGswx61kS/7mtYdu576TrsENTzn5ozN5gRwO:fJmW7uyLGKkS/7bulArsETzn5ozC
TLSH
T1ABC49E86E2A453FAE06790389556A20BF972385407608FDB33E449B52F933E16F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GK.exe

File Explorer

GK.exe

.exe 534KB

GK.exe

IMPHASH 4d71ac4311038af500b22a3fc1447244
SHA256 ceca7da25b7af7d3545c553b8285145f19d687708811ca9a2155e5854d50f1f1
MD5 c40556fc12176275af207eb26de75f39
SHA1 b8eaa3d8951f9116401bf7d059a5ea8d4ee67e43
SHA512 7d332abaa93c89459756ef580367a9aef5ff7c905ae5f6a7688eb15cb8652515873e5acfe49ac7dbfbc499d7917546a291c0d029a3ec16e2a656fe4059171021
SSDEEP 6144:Y8J2TWRZ4IMquV3ojGy8UnGswx61kS/7mtYdu576TrsENTzn5ozN5gRwO:fJmW7uyLGKkS/7bulArsETzn5ozC
TLSH
T1ABC49E86E2A453FAE06790389556A20BF972385407608FDB33E449B52F933E16F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

258980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\bombo\OneDrive\Desktop\source_[unknowncheats.me]_\CB111\x64\Release\CB.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW WriteConsoleW SetFilePointerEx LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WideCharToMultiByte GetModuleHandleW GetWindowsDirectoryA GetFileAttributesA GetLastError SetEndOfFile GetConsoleMode GetExitCodeThread ExitThread CreateThread LoadLibraryExW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId CloseHandle WaitForSingleObjectEx InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

DestroyWindow EndPaint BeginPaint UpdateWindow GetKeyState GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor SetProcessDPIAware ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetDC MapVirtualKeyA BroadcastSystemMessageW ReleaseDC GetCursorPos DefWindowProcW MapVirtualKeyW MonitorFromPoint PostQuitMessage SetWindowPos EqualRect SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity GetForegroundWindow SetLayeredWindowAttributes TranslateMessage GetClientRect GetKeyNameTextW InvalidateRect

gdi32

Ellipse CreateCompatibleBitmap Rectangle CreatePen SetPixelV GetDeviceCaps BitBlt DeleteObject CreateCompatibleDC GetDIBits DeleteDC SelectObject GetStockObject

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GK.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

imm32

generic