osuPoint[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
osuPoint.exe
Size 596KB
Sample261102-ls36vsvs3l
SHA256 077372036b57cff7664413bbc8ee3a8d0d0d93017a7e41d8650160d6d551235c
MD5 6949407099bc36e4e4c5fc3b97424baa
SHA1 f390cd84e21e8d43e5a54aea0340c97dff40f97f
SHA512 862e6ba29edad8308c496645500db002e76a7c999fa17f57c495761d3e135b87341ab1999fd3535af8d2cbc1e08ffcfba9effabe91521ac1d8c94bfdd9731380
SSDEEP 6144:xjBW914hMVroPBWs2BdBlV1nSGYGpATf5K2CRL1LAt/DYR9XiqgOak1UMWtXvEbr:dBW9GhmNlCOpaK2edA5NqAeUMWt6h3V
TLSH
T149D49E05B76413FDD567C2B8C9174A42EB72F84A03706BEB039089A62F276E45F7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
osuPoint.exe

File Explorer

osuPoint.exe

.exe 596KB

osuPoint.exe

IMPHASH 423f61cc23ed0c509649477e6c0b5dcf
SHA256 077372036b57cff7664413bbc8ee3a8d0d0d93017a7e41d8650160d6d551235c
MD5 6949407099bc36e4e4c5fc3b97424baa
SHA1 f390cd84e21e8d43e5a54aea0340c97dff40f97f
SHA512 862e6ba29edad8308c496645500db002e76a7c999fa17f57c495761d3e135b87341ab1999fd3535af8d2cbc1e08ffcfba9effabe91521ac1d8c94bfdd9731380
SSDEEP 6144:xjBW914hMVroPBWs2BdBlV1nSGYGpATf5K2CRL1LAt/DYR9XiqgOak1UMWtXvEbr:dBW9GhmNlCOpaK2edA5NqAeUMWt6h3V
TLSH
T149D49E05B76413FDD567C2B8C9174A42EB72F84A03706BEB039089A62F276E45F7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

293760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipCreatePen1 GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipDrawImageRectRect GdipCloneImage GdipBitmapUnlockBits GdipDeleteBrush GdipAlloc GdipDrawImageRectI GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipCreatePath GdipFillPolygon GdipSetInterpolationMode GdipCreateSolidFill GdipFillPath GdipGraphicsClear GdipDrawLine GdipSetPixelOffsetMode GdipClosePathFigure GdipFree GdipDrawPath GdipBitmapLockBits GdipSetPenLineJoin GdipCreateFromHDC GdipFillEllipse GdipDrawEllipse GdipGetImageGraphicsContext GdipAddPathArc GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromFile GdipDeletePen GdipCreateBitmapFromScan0 GdipDrawPolygon

comdlg32

ChooseColorA GetOpenFileNameA

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

hid

HidD_GetIndexedString HidD_GetProductString HidD_GetAttributes HidD_FlushQueue HidD_SetOutputReport HidP_GetCaps HidD_GetPreparsedData HidD_FreePreparsedData HidD_SetFeature HidD_GetHidGuid

user32

ReleaseCapture UnregisterDeviceNotification RegisterDeviceNotificationA GetSystemMetrics ShowWindow DeleteMenu GetSystemMenu PostMessageA InvalidateRect SendMessageA GetMonitorInfoA DeferWindowPos GetMessageA DispatchMessageA GetWindowRect GetFocus LoadCursorA DestroyWindow GetDC IsWindowVisible SetWindowPos InsertMenuA GetDpiForWindow FillRect ScreenToClient MessageBeep CreatePopupMenu TrackPopupMenu IsWindow BeginDeferWindowPos OffsetRect RegisterWindowMessageA GetDlgItemTextA SetTimer RedrawWindow DestroyIcon IsDialogMessageA DrawTextA CreateIconIndirect ClientToScreen CallWindowProcA MapWindowPoints AdjustWindowRect RegisterClassA DefWindowProcA DestroyMenu CreateWindowExA SetFocus TranslateMessage SetCapture GetWindowDC EndDeferWindowPos SetCursor LoadIconA GetClientRect GetWindowLongPtrA KillTimer PostQuitMessage SetWindowLongPtrA UpdateWindow SetWindowTextA SetForegroundWindow ReleaseDC GetCursorPos BeginPaint EndPaint EnableWindow EnumDisplayMonitors GetWindowTextA SendInput

gdi32

SelectObject CreateDIBSection CreateCompatibleDC GetStockObject Polyline GetPixel DeleteDC SetTextColor SetBkMode LineTo CreateFontA Polygon ExcludeClipRect MoveToEx SetBkColor Ellipse CreateBitmap RoundRect CreatePen DeleteObject CreateSolidBrush CreateCompatibleBitmap Rectangle BitBlt

winmm

timeBeginPeriod timeEndPeriod

dwmapi

DwmGetColorizationColor DwmSetWindowAttribute

shell32

Shell_NotifyIconA

avrt

AvSetMmThreadPriority AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsA

advapi32

RegGetValueW RegGetValueA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

kernel32

ReadFile AllocConsole WriteFile WaitForMultipleObjects HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetThreadAffinityMask HeapAlloc TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread IsProcessorFeaturePresent SetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader VirtualProtect InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FreeConsole GetTickCount64 GetCommandLineA SetPriorityClass CancelIo MulDiv DeleteFileA GetFileAttributesA CopyFileA GetFileAttributesExW MultiByteToWideChar FindClose GetModuleFileNameW FindNextFileW FindFirstFileW SetFileCompletionNotificationModes GetTickCount QueryPerformanceCounter CreateEventA SetThreadExecutionState LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindFirstFileExW GetCommandLineW GetEnvironmentStringsW GetFileType FreeEnvironmentStringsW GetPriorityClass SetThreadIdealProcessor GetOverlappedResult CancelIoEx QueryPerformanceFrequency SetEvent SetConsoleOutputCP GetConsoleWindow GetProcessHeap WriteConsoleW HeapSize SetEndOfFile GetStartupInfoW RtlUnwind GetLastError Sleep CreateFileW WaitForSingleObject SetThreadInformation SetConsoleTitleA GetCurrentProcess SetProcessInformation GetStdHandle SetConsoleMode GetProcessAffinityMask GetModuleHandleA CreateToolhelp32Snapshot GetConsoleMode AttachConsole GetLogicalProcessorInformationEx Process32NextW GetCurrentThread LoadLibraryA Process32FirstW CloseHandle GetProcAddress SetConsoleCP GetCurrentProcessId WideCharToMultiByte SetThreadPriority

Name

.text

Size

476KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

osuPoint.exe

gdiplus

comdlg32

setupapi

hid

user32

gdi32

winmm

dwmapi

shell32

avrt

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

generic