AutoClicker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AutoClicker.exe
Size 947KB
Sample261102-18e7asxtaz
SHA256 bf2b1ebfceb98d86091cb860d64261eedbe5785d9ddb9ae1834f4896266bc0c9
MD5 3c0d87d2bab7f5fa8212211a80a84f6f
SHA1 b434efad4181cfc0e9a0336fbbf3a2c428b1674e
SHA512 38fedf350086c49d9571704aff2d8d55804e88661f8f7e69846656f3fffd11afb951c4eb45252051b10626ff208e2b64459560e1a9fd21a882f4f502dedc879c
SSDEEP 24576:udM0upDffi0dnqrjgyL0ZeGB4n6QnVUM8:uudnOacuCn
TLSH
T112258D41F1A455EDE067E03886ABB60BF975389803105BCB73E4D5682FE36E47ABF211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AutoClicker.exe

File Explorer

AutoClicker.exe

.exe 947KB

AutoClicker.exe

IMPHASH dadefb9e481431dc508a1acd35eeb885
SHA256 bf2b1ebfceb98d86091cb860d64261eedbe5785d9ddb9ae1834f4896266bc0c9
MD5 3c0d87d2bab7f5fa8212211a80a84f6f
SHA1 b434efad4181cfc0e9a0336fbbf3a2c428b1674e
SHA512 38fedf350086c49d9571704aff2d8d55804e88661f8f7e69846656f3fffd11afb951c4eb45252051b10626ff208e2b64459560e1a9fd21a882f4f502dedc879c
SSDEEP 24576:udM0upDffi0dnqrjgyL0ZeGB4n6QnVUM8:uudnOacuCn
TLSH
T112258D41F1A455EDE067E03886ABB60BF975389803105BCB73E4D5682FE36E47ABF211
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

password

Minor OS version

Major OS version

Entry point

361728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\potanya\Desktop\dsa\x64\Release\AutoClicker.pdb

kernel32

ExitProcess CheckRemoteDebuggerPresent MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter WriteProcessMemory GetTempPathW GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable VirtualAlloc SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive DeviceIoControl CreateRemoteThread GetCurrentProcess GetCurrentProcessId GetModuleHandleA GetCurrentThreadId InitializeSListHead GetModuleHandleW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW LoadLibraryA Process32FirstW CloseHandle GetProcAddress VirtualAllocEx CreateFileW VirtualFree VirtualFreeEx

user32

GetWindowLongW AdjustWindowRectEx GetKeyState GetDC MonitorFromWindow EnumDisplayMonitors ScreenToClient SetWindowTextW WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent GetForegroundWindow SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect SetProcessDPIAware ReleaseCapture SetForegroundWindow IsIconic ReleaseDC RegisterClassExW DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW mouse_event GetCursorPos UpdateWindow PostQuitMessage TranslateMessage PeekMessageW DispatchMessageW ShowWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState SetCursorPos

gdi32

GetDeviceCaps

advapi32

QueryServiceStatusEx CloseServiceHandle OpenSCManagerW ControlService ChangeServiceConfigW OpenServiceW RegOpenKeyW RegSetKeyValueW RegCloseKey RegDeleteTreeW RegCreateKeyW

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Xbad_alloc@std@@YAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtQuerySystemInformation NtLoadDriver RtlAdjustPrivilege RtlInitUnicodeString NtUnloadDriver

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_terminate __std_exception_destroy __std_exception_copy wcsstr strstr memchr memcmp _CxxThrowException memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strncpy wcslen strcmp strncmp strlen _stricmp _wcsicmp

api-ms-win-crt-stdio-l1-1-0

ungetc __stdio_common_vfprintf fsetpos fgetpos __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen _set_fmode _fseeki64 fseek __acrt_iob_func _get_stream_buffer_pointers fwrite fgetc __p__commode ftell fclose fflush fputc setvbuf

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_beginthreadex exit terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

sinf acosf ceilf fmodf cosf sqrtf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale