TT2018_38[.]exe | Triage™

General

Target
TT2018_38.exe
Size 10.8MB
Sample261027-y2k3vsfx6v
SHA256 4506ff09a9f506e7dfe6d8d437d61c46ea38ba22e09c68bf444fbae64754de70
MD5 21bf480baa7d652d8d7683ff84c0d36f
SHA1 eca44bffe6865ec322e18b2fcda045480512920a
SHA512 8aba911b3f05eaa4aa49fb60d9a7b5382e2878339e8d33c102681c20375bd639f243f3d99bdcd89327f09504f143139fe09bb4afff72be86a7c1d536e4103214
SSDEEP 196608:/oTRwc0DV8Es7N/6mP5W4lrgDPCDcEU03xwEzaZW7bTfT/AXebutTa6HZi/QZbng:Wp0JsxCYW4GEziZW7bT2CuA65ioZbnyh
TLSH
T1C9B63383B6B2C039C26A00720575D3E98D21AE725778E4F3DFD4395D8E796E19738E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TT2018_38.exe

File Explorer

TT2018_38.exe

.exe 10.8MB

TT2018_38.exe

IMPHASH 0047ffc8d91ee9a957961742504880d6
SHA256 4506ff09a9f506e7dfe6d8d437d61c46ea38ba22e09c68bf444fbae64754de70
MD5 21bf480baa7d652d8d7683ff84c0d36f
SHA1 eca44bffe6865ec322e18b2fcda045480512920a
SHA512 8aba911b3f05eaa4aa49fb60d9a7b5382e2878339e8d33c102681c20375bd639f243f3d99bdcd89327f09504f143139fe09bb4afff72be86a7c1d536e4103214
SSDEEP 196608:/oTRwc0DV8Es7N/6mP5W4lrgDPCDcEU03xwEzaZW7bTfT/AXebutTa6HZi/QZbng:Wp0JsxCYW4GEziZW7bT2CuA65ioZbnyh
TLSH
T1C9B63383B6B2C039C26A00720575D3E98D21AE725778E4F3DFD4395D8E796E19738E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10737

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA lstrcpyA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize CompareStringA DeleteFileA Sleep IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing