suhina[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
suhina.exe
Size 48.7MB
Sample261029-vfc9cabg52
SHA256 af08f5347cadbdb61f624c9296395f3b27c792c4ea8d9b96aad0b6ed134dd00b
MD5 5de88311888bcf38f9a9a75deab30306
SHA1 91d7d9f218cc68e1b52bc1db3f55899ae3b3009e
SHA512 0dc66e95c68d63c54fbae3a56efa45cc7671f83a19e336d5f6364fa0f449516ba491c9582571e40732494126dffee0991b44fb72c41f37530119d60dfcb16a26
SSDEEP 786432:54oDCdm7sPZNADIiZ1fv/wgENIWv/9/do9reV:54oxekv/w9Dv/hK9
TLSH
T16BB75C41BA5B58ADD19AC8B083468A375F2134CB0726B8FF51C496383F7DBE05B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
suhina.exe

File Explorer

suhina.exe

.exe 48.7MB

suhina.exe

IMPHASH 45c07ec164fc8ddef61f74bf9a376f2b
SHA256 af08f5347cadbdb61f624c9296395f3b27c792c4ea8d9b96aad0b6ed134dd00b
MD5 5de88311888bcf38f9a9a75deab30306
SHA1 91d7d9f218cc68e1b52bc1db3f55899ae3b3009e
SHA512 0dc66e95c68d63c54fbae3a56efa45cc7671f83a19e336d5f6364fa0f449516ba491c9582571e40732494126dffee0991b44fb72c41f37530119d60dfcb16a26
SSDEEP 786432:54oDCdm7sPZNADIiZ1fv/wgENIWv/9/do9reV:54oxekv/w9Dv/hK9
TLSH
T16BB75C41BA5B58ADD19AC8B083468A375F2134CB0726B8FF51C496383F7DBE05B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35769024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

suhina.pdb

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile

oleaut32

VariantClear SafeArrayCreateVector SysFreeString SysAllocStringLen SysStringLen SafeArrayPutElement SetErrorInfo GetErrorInfo

kernel32

FlsFree FlsAlloc IsThreadAFiber FlsSetValue WaitForMultipleObjects OpenProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlUnwindEx SetUnhandledExceptionFilter SetThreadPriority GetExitCodeProcess HeapSize SetStdHandle VirtualProtect OutputDebugStringW IsDebuggerPresent GetFileType RaiseException CreateProcessW RtlPcToFileHeader SetLastError GetSystemTimeAsFileTime EncodePointer IsProcessorFeaturePresent FlsGetValue GetStartupInfoW GetProcAddress LoadLibraryExA GetProcessHeap HeapFree HeapAlloc FormatMessageW WaitForSingleObject UnhandledExceptionFilter GetTimeZoneInformationForYear Sleep ReleaseSemaphore CreateWaitableTimerExW SetWaitableTimer ReleaseMutex CreateMutexA TerminateProcess ExitProcess GetCurrentProcessId SetThreadStackGuarantee WaitForSingleObjectEx GlobalAlloc GlobalLock CreateSemaphoreW GlobalUnlock SetThreadErrorMode LoadLibraryExW LoadLibraryW GetSystemTimePreciseAsFileTime GlobalSize CompareStringW LCMapStringW DuplicateHandle GetCurrentProcess SleepEx LocalFree CreateThread GetCurrentThreadId WaitForMultipleObjectsEx CreateEventA CreateEventW IsValidCodePage GetACP QueryPerformanceFrequency lstrlenW AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext CompareStringOrdinal QueryPerformanceCounter SetEvent CloseHandle SwitchToThread GetOEMCP WideCharToMultiByte MultiByteToWideChar LocaleNameToLCID GetCPInfo HeapReAlloc FreeLibrary GetFileInformationByHandle GetFileInformationByHandleEx GlobalFree GetCurrentThread GetLastError GetStringTypeW InitializeSListHead FlushFileBuffers CreateNamedPipeW WriteFileEx ReadFileEx SetNamedPipeHandleState ConnectNamedPipe DisconnectNamedPipe LocalAlloc CreateIoCompletionPort PostQueuedCompletionStatus GetFullPathNameW RemoveVectoredExceptionHandler GetQueuedCompletionStatusEx ReadFile GetOverlappedResult WriteFile CancelIoEx CancelIo CreateFileW ReadDirectoryChangesW FindClose GetModuleHandleA GetSystemInfo VirtualQuery GetStdHandle CopyFileExW CreateHardLinkW SetFileInformationByHandle RtlLookupFunctionEntry MapViewOfFile SetFileTime GetSystemDirectoryW GetWindowsDirectoryW CreateDirectoryW SetFilePointerEx RemoveDirectoryW SetFileAttributesW MoveFileExW FindFirstFileExW LoadLibraryA GetFinalPathNameByHandleW CreateSymbolicLinkW CreateFileMappingW DeleteFileW DeviceIoControl GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleHandleExW GetModuleHandleW GetTempPathW FindNextFileW GetFileSizeEx UnmapViewOfFile FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineA GetCurrentDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW

advapi32

AddAce GetSidSubAuthorityCount InitializeSecurityDescriptor GetSidLengthRequired SetSecurityDescriptorOwner FreeSid SetSecurityDescriptorGroup RevertToSelf ImpersonateAnonymousToken IsValidSid CopySid SetSecurityDescriptorControl GetSecurityDescriptorControl InitializeAcl GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorGroup SetSecurityDescriptorDacl SetSecurityDescriptorSacl GetAclInformation GetAce

ole32

StringFromIID RevokeDragDrop CoTaskMemFree PropVariantClear CoCreateInstance CoUninitialize OleInitialize CoCreateFreeThreadedMarshaler RegisterDragDrop CoInitializeEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

mmdevapi

ActivateAudioInterfaceAsync

shell32

DragQueryFileW DragFinish SHGetKnownFolderPath SHCreateItemFromParsingName

winmm

midiInStop midiInReset midiInUnprepareHeader midiInGetNumDevs midiInOpen midiInPrepareHeader midiInStart midiInGetDevCapsW midiInMessage midiInClose midiInAddBuffer

propsys

PropVariantToStringAlloc

shlwapi

AssocQueryStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

user32

GetForegroundWindow SetForegroundWindow MsgWaitForMultipleObjectsEx SetCursorPos SetWindowTextW IsProcessDPIAware GetAsyncKeyState GetDC GetClassNameW GetWindowRect FlashWindowEx GetKeyState MapVirtualKeyW MonitorFromWindow SetWindowPlacement SetWindowDisplayAffinity GetWindowPlacement DestroyCursor SetCursor LoadCursorW InvalidateRgn DefWindowProcA CreateIconFromResourceEx RegisterRawInputDevices GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo IsIconic CreateIconIndirect GetRawInputData RegisterClassExW CreateWindowExW RegisterWindowMessageA ShowCursor GetMonitorInfoW ClipCursor MonitorFromPoint GetClientRect RedrawWindow EnumDisplayMonitors SystemParametersInfoA GetWindowLongPtrW DispatchMessageW TranslateMessage PeekMessageW SendMessageW GetSystemMetrics GetActiveWindow PostMessageW DestroyWindow ReleaseDC IsWindowVisible RemovePropW ClientToScreen DefWindowProcW CallWindowProcW GetClipCursor DestroyIcon SetWindowLongPtrW SetPropW CreateIcon GetPropW GetKeyboardState MapVirtualKeyExW RegisterClassExA SendInput GetKeyboardLayout ToUnicodeEx GetClassInfoExW GetClassInfoExA AdjustWindowRectEx CreateWindowExA GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow GetWindowTextW GetWindowTextLengthW ValidateRect TrackMouseEvent SetCapture MonitorFromRect ScreenToClient GetMenu ReleaseCapture GetFocus ChangeDisplaySettingsExW SetFocus GetCursorPos SetWindowPos SetClipboardData GetTouchInputInfo EmptyClipboard CloseTouchInputHandle RegisterTouchWindow GetClipboardData IsClipboardFormatAvailable OpenClipboard CloseClipboard RegisterClipboardFormatW

gdi32

DeleteObject CreateRectRgn SwapBuffers SetPixelFormat ChoosePixelFormat DescribePixelFormat SetBitmapBits CreateBitmap GetPixelFormat GetDeviceCaps CreateCompatibleBitmap

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uiautomationcore

UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

opengl32

wglGetCurrentContext wglGetProcAddress wglMakeCurrent wglGetCurrentDC wglShareLists wglDeleteContext wglCreateContext

dxgi

CreateDXGIFactory1

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

imm32

ImmAssociateContextEx ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmGetCompositionStringW ImmSetCompositionWindow

psapi

GetProcessMemoryInfo

uxtheme

SetWindowTheme

Name

.text

Size

34.9MB

Virtual Size

34.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

990KB

Virtual Size

989KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

suhina.exe

ntdll

oleaut32

kernel32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

mmdevapi

shell32

winmm

propsys

shlwapi

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

user32

gdi32

dwmapi

uiautomationcore

opengl32

dxgi

setupapi

imm32

psapi

uxtheme

generic