task_354[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
task_354.exe
Size 2.2MB
Sample261031-3ettpsey8w
SHA256 d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d
MD5 72efd05c4a0117643365c18ac8de7aff
SHA1 b67d01ef6dce5d2b36175b82a98c8431879bd151
SHA512 19aaddcc76acc32a4fed6c26ba631c30e2191ecdaa736446f0507dd6f1eadb4d18b0113e7e87d81bdcab4042b593c15ae1346afb4a90b3fbef7aabaa65a5ede8
SSDEEP 49152:xOSGeRfUXpRP9IT6z+YocKhqPeGiZ4/CHdd1IKxD6:wRP9I6DocKQPLiKKHzCKh
TLSH
T102B5F17EDF89939AC19411FA8C78E758F44D8DC08E0961C5CFE049E2C1AE308B569BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
task_354.exe

File Explorer

task_354.exe

.exe 2.2MB

task_354.exe

IMPHASH 37743d7489df28a272454846976806b6
SHA256 d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d
MD5 72efd05c4a0117643365c18ac8de7aff
SHA1 b67d01ef6dce5d2b36175b82a98c8431879bd151
SHA512 19aaddcc76acc32a4fed6c26ba631c30e2191ecdaa736446f0507dd6f1eadb4d18b0113e7e87d81bdcab4042b593c15ae1346afb4a90b3fbef7aabaa65a5ede8
SSDEEP 49152:xOSGeRfUXpRP9IT6z+YocKhqPeGiZ4/CHdd1IKxD6:wRP9I6DocKQPLiKKHzCKh
TLSH
T102B5F17EDF89939AC19411FA8C78E758F44D8DC08E0961C5CFE049E2C1AE308B569BDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertCompareCertificateName CertRegisterPhysicalStore CertGetCertificateContextProperty CertOpenSystemStoreW

secur32

RevertSecurityContext

kernel32

LoadLibraryExW FindActCtxSectionGuid GetStringTypeA GetModuleFileNameA GetModuleHandleA GetModuleFileNameW SetCommConfig AddRefActCtx GetProcessVersion GetTimeZoneInformation GetExitCodeThread DisableThreadLibraryCalls MulDiv GetProcessId IsWow64Process GetSystemTimeAsFileTime SetConsoleCursorPosition GetVersionExA GetVersion GetLocalTime IsDebuggerPresent FileTimeToDosDateTime EnterCriticalSection InterlockedPushEntrySList QueueUserAPC ReplaceFileW FreeEnvironmentStringsW BuildCommDCBAndTimeoutsA

netapi32

NetQueryDisplayInformation

oleaut32

LoadTypeLibEx LoadRegTypeLi VarI2FromCy SafeArrayGetLBound VarBstrFromUI4 VarDateFromCy BSTR_UserSize

msvcrt

memset wcstol

setupapi

SetupDiDrawMiniIcon SetupDiGetDeviceInstallParamsW SetupOpenInfFileW SetupSetDirectoryIdExW CM_Get_Device_ID_ExA

comctl32

ImageList_Create

ws2_32

select

pdh

PdhParseCounterPathW

advapi32

GetPrivateObjectSecurity ChangeServiceConfigW RegCreateKeyA CryptDestroyHash

rpcrt4

RpcServerUseProtseqExW NdrUserMarshalUnmarshall RpcRevertToSelf RpcBindingToStringBindingW RpcEpUnregister IUnknown_Release_Proxy NdrInterfacePointerMarshall RpcBindingReset

gdi32

GetStockObject GetTextColor PatBlt GetClipBox CombineRgn GetViewportOrgEx RoundRect GetRegionData GetTextMetricsW GetRandomRgn GetNearestPaletteIndex

winspool.drv

DeleteFormW FindNextPrinterChangeNotification

wintrust

CryptCATAdminAcquireContext

shlwapi

StrFormatByteSizeW GetMenuPosFromID StrRetToBufW PathAddBackslashA AssocQueryStringByKeyW PathCanonicalizeW StrCmpNIW

user32

DeregisterShellHookWindow DrawIcon SetPropW ExitWindowsEx IsChild ShowWindow BroadcastSystemMessageA VkKeyScanExW DefWindowProcA CreateDialogIndirectParamW

ole32

OleUninitialize STGMEDIUM_UserUnmarshal

winmm

mixerGetControlDetailsW midiOutGetDevCapsA

rasapi32

RasGetEapUserIdentityW

generic

count=260, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=352, id=1, productName=Unmarked objects,

count=496, id=109, productName=VS2005 build 50727, version=50727,

count=125, id=204, productName=VS2012 UPD4 build 61030, version=61030,

count=383, id=261, productName=VS2015 UPD3 build 24213, version=24213,

count=238, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=28, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=208, id=202, productName=VS2012 UPD2 build 60315, version=60315,

count=398, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=172, id=205, productName=VS2012 UPD1 build 51106, version=51106,

count=260, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=391, id=203, productName=VS2012 UPD1 build 51106, version=51106,

count=423, id=109, productName=VS2005 build 50727, version=50727,

count=498, id=257, productName=VS2015 UPD2 build 23918, version=23918,

count=31, id=202, productName=VS2012 UPD3 build 60610, version=60610,