tg-ws-proxy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tg-ws-proxy.exe
Size 24.1MB
Sample261030-a7hypach78
SHA256 7491f3a43272c5d73553f7878e9309de6320738bd19ff6c9bf6594879781ca4e
MD5 770bb96ca7fc9532d9f4cc4e3bafde29
SHA1 ef7b0896fd20bcb0afbe7c40cb0d7a9b3c42bd38
SHA512 42064bce4b1b1105fff24e47e44159761974803d27cff1726bb87be95f074bbfc67be2897eed52bd2b20b84a5bcb5d8e76fb0bb87736ee5b2b5cf2a33e1a5319
SSDEEP 786432:JcqW88YFrHFFb0k1QtIcCuAHsM8axJMNdEEF3XrQpR5SWQ1:JLWXYFzFFAwiIpZHyVc0
TLSH
T1604733A9B3E204F6D9FA453A95E78103DBA178E603B197CB5BE00D921F132E5DE38750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tg-ws-proxy.exe

File Explorer

tg-ws-proxy.exe

.exe 24.1MB
windows.pyc

44KB

tg-ws-proxy.exe

IMPHASH 7ded604015975929b583962a247d21ca
SHA256 7491f3a43272c5d73553f7878e9309de6320738bd19ff6c9bf6594879781ca4e
MD5 770bb96ca7fc9532d9f4cc4e3bafde29
SHA1 ef7b0896fd20bcb0afbe7c40cb0d7a9b3c42bd38
SHA512 42064bce4b1b1105fff24e47e44159761974803d27cff1726bb87be95f074bbfc67be2897eed52bd2b20b84a5bcb5d8e76fb0bb87736ee5b2b5cf2a33e1a5319
SSDEEP 786432:JcqW88YFrHFFb0k1QtIcCuAHsM8axJMNdEEF3XrQpR5SWQ1:JLWXYFzFFAwiIpZHyVc0
TLSH
T1604733A9B3E204F6D9FA453A95E78103DBA178E603B197CB5BE00D921F132E5DE38750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostQuitMessage ShowWindow CreateWindowExW DefWindowProcW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterClassExW SetCapture SetProcessDPIAware DestroyIcon LoadCursorW GetClassNameA EnumChildWindows WindowFromPoint ScreenToClient MessageBoxW GetWindowTextW SetWindowTextW UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu ReleaseCapture wsprintfW

gdi32

SetBkColor CreateSolidBrush CreateFontIndirectW SetTextColor

comctl32

ImageList_Create ImageList_ReplaceIcon ord17

shell32

DragQueryFileW DragFinish SHFileOperationW ShellExecuteExW SHGetFileInfoW CommandLineToArgvW

comdlg32

GetOpenFileNameW GetSaveFileNameW

shlwapi

PathFileExistsW PathFindFileNameW PathIsDirectoryW

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptEncrypt

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW FindFirstFileExW ReadFile GetConsoleMode GetConsoleOutputCP GetProcessHeap GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx SetStdHandle HeapSize WriteConsoleW GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect SetEndOfFile FlushFileBuffers HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree WriteFile GetStdHandle GetProcAddress GetModuleHandleExW FreeLibrary GetCommandLineW GetEnvironmentVariableW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetFullPathNameW GetTempPathW CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep WaitForMultipleObjects GetCurrentProcessId GetModuleFileNameW LocalFree BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetPrivateProfileStringW WritePrivateProfileStringW RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tg-ws-proxy.exe

user32

gdi32

comctl32

shell32

comdlg32

shlwapi

bcrypt

kernel32

generic

windows.pyc