Sinner UM[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Sinner UM.exe
Size 769KB
Sample261030-lyc7maxybs
SHA256 fb54b94f232a6d5f7431f922ffac9b83c917e33dc816ac4c2ac2b48d30e5bf5c
MD5 343790fe6f9fb3f1dc9a256bacaa6d1d
SHA1 d8c2a5b83aca9e9a88e1d015eb15237415e2fe39
SHA512 924064937ece35b6fe62ea09ff8d00b1bc77cadcc89daa254fcfde22afe6f262b265264ecf162d0813bffefaa09be589ed7e008fe3e0dc9909e72777ec22e401
SSDEEP 24576:h5AtJ72TUzj6DNG8VvqBlbZMbnS2JRl9F:h6tJOUqpG8VvqBlandZ
TLSH
T14CF49E86F2A446E8D167D2788617A31BF77574090310ABCB27E44B6A3F53AE16F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sinner UM.exe

File Explorer

Sinner UM.exe

.exe 769KB

Sinner UM.exe

IMPHASH d4bc79ab3992ef6d887a76cf284e06a5
SHA256 fb54b94f232a6d5f7431f922ffac9b83c917e33dc816ac4c2ac2b48d30e5bf5c
MD5 343790fe6f9fb3f1dc9a256bacaa6d1d
SHA1 d8c2a5b83aca9e9a88e1d015eb15237415e2fe39
SHA512 924064937ece35b6fe62ea09ff8d00b1bc77cadcc89daa254fcfde22afe6f262b265264ecf162d0813bffefaa09be589ed7e008fe3e0dc9909e72777ec22e401
SSDEEP 24576:h5AtJ72TUzj6DNG8VvqBlbZMbnS2JRl9F:h6tJOUqpG8VvqBlandZ
TLSH
T14CF49E86F2A446E8D167D2788617A31BF77574090310ABCB27E44B6A3F53AE16F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

565664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Nebula PC\Downloads\6ssebn\MemoCC_Sol\MemoCC_Sol\build\Sinner UM.pdb

kernel32

GetConsoleWindow lstrcmpiW SetConsoleTitleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter InitializeSListHead Process32FirstW GetCurrentThreadId GetCurrentProcessId GetModuleHandleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CloseHandle Process32NextW SetLastError GetLastError Sleep CreateToolhelp32Snapshot CreateFileW DeviceIoControl GetSystemTimeAsFileTime

user32

GetClipboardData EmptyClipboard CloseClipboard GetSystemMetrics GetKeyState ScreenToClient ClientToScreen SetCursor GetClientRect SetCursorPos SetClipboardData ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetForegroundWindow EnumWindows DefWindowProcA GetWindowThreadProcessId GetWindow GetWindowRect DestroyWindow SetWindowPos CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW SetWindowLongW GetDesktopWindow RegisterClassExA UpdateWindow GetCursorPos OpenClipboard

shell32

ShellExecuteA

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __current_exception __current_exception_context __C_specific_handler __intrinsic_setjmp _CxxThrowException memchr __std_exception_destroy __std_exception_copy __std_terminate strstr memmove strrchr memset memcpy longjmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _cexit _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _invoke_watson _beginthreadex terminate system _register_onexit_function _seh_filter_exe _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fopen _set_fmode ftell __acrt_iob_func __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fflush __p__commode __stdio_common_vfprintf fseek fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strncpy strcmp

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-convert-l1-1-0

atof atol

api-ms-win-crt-math-l1-1-0

powf cosf sinf sqrtf ceilf logf atan2 tanf asin acosf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale