Syspkg98[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Syspkg98.exe
Size 1.8MB
Sample261102-3cb6wadx71
SHA256 77f0aff4c007f47a9ecd9555645879c778bfc32722c2e152df0bfffc17c1fc9e
MD5 af0aa2fa908f5199751c6ad06dfefec0
SHA1 8cf8f9e4f3ad9e28265ff473db7993b166291c77
SHA512 e787a860dd5a8c6640b0677a7473098724c35bbb6b45168b06ba68c6deb800065c704e5bd3d4a927e5cb814cb7459db309b663f11fb69b813f1bf3464edb306a
SSDEEP 24576:Aog4OCPZUczrCTMHtwLdBR2Et+OHEbJiaY5o5Hpr:Aog/CWJ52EtgQc5Hpr
TLSH
T1D4958B43F287ED95C13142314FB3C3D81728BC98AD529A1F3988BB2E9E3B6817E56355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Syspkg98.exe

File Explorer

Syspkg98.exe

.exe 1.8MB

Syspkg98.exe

IMPHASH 427ea1309051d299406a9704785e45b1
SHA256 77f0aff4c007f47a9ecd9555645879c778bfc32722c2e152df0bfffc17c1fc9e
MD5 af0aa2fa908f5199751c6ad06dfefec0
SHA1 8cf8f9e4f3ad9e28265ff473db7993b166291c77
SHA512 e787a860dd5a8c6640b0677a7473098724c35bbb6b45168b06ba68c6deb800065c704e5bd3d4a927e5cb814cb7459db309b663f11fb69b813f1bf3464edb306a
SSDEEP 24576:Aog4OCPZUczrCTMHtwLdBR2Et+OHEbJiaY5o5Hpr:Aog/CWJ52EtgQc5Hpr
TLSH
T1D4958B43F287ED95C13142314FB3C3D81728BC98AD529A1F3988BB2E9E3B6817E56355
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Infected

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject SelectObject SetBrushOrgEx SetStretchBltMode StretchBlt

kernel32

CloseHandle DeleteCriticalSection EnterCriticalSection FindResourceW GetLastError GetStartupInfoW GetThreadId GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadResource LockResource MulDiv MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _wcmdln abort calloc exit fprintf fputc fputs free fwrite getenv localeconv malloc memcmp memcpy memset rand realloc signal srand strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen

user32

AdjustWindowRectEx BeginPaint CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EndPaint FillRect GetClientRect GetDC GetMessageW GetSystemMetrics GetWindowLongPtrW GetWindowRect InvalidateRect IsWindow KillTimer LoadCursorW LoadIconW LoadImageW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SetTimer SetWindowLongPtrW SetWindowPos ShowWindow TranslateMessage UpdateWindow

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

772B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

954B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Syspkg98.exe

comctl32

gdi32

kernel32

msvcrt

user32

winmm

generic