Spotify[.]exe | Triage™

General

Target
Spotify.exe
Size 108.3MB
Sample261102-rcwpqsfc75
SHA256 ed54938ac8cb188bfc2c1a8c89a851a73ae7aaa8f57852f61c51249fbdd4935c
MD5 d3481b1f68e68e704d8afb6bb398b797
SHA1 14394f1f356ebc2213e04cb414a651edc5814a99
SHA512 2fef1ba365946767a129e238b805d4e8f709ff36e99c5835bac40ebfdd93ec9525730437a3cdf24fdaf9c25bf59aa5b8586c76d42d03cea7ec82ad551c7c78ec
SSDEEP 3145728:0y6wK/3YQeljvSkvxD8S3iMTRj2U0hSko8v8OMQPi:0T5/INR5vCS3ikRgAko8UOnPi
TLSH
T15C48330AD7541AF9F0EB617889928835E772F972476497DF13600B7B6E633D08E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Spotify.exe

File Explorer

Spotify.exe

.exe 108.3MB
entry_nice.pyc

44KB

Spotify.exe

IMPHASH a8c58d862d01266ef1c0f2ff0142b16e
SHA256 ed54938ac8cb188bfc2c1a8c89a851a73ae7aaa8f57852f61c51249fbdd4935c
MD5 d3481b1f68e68e704d8afb6bb398b797
SHA1 14394f1f356ebc2213e04cb414a651edc5814a99
SHA512 2fef1ba365946767a129e238b805d4e8f709ff36e99c5835bac40ebfdd93ec9525730437a3cdf24fdaf9c25bf59aa5b8586c76d42d03cea7ec82ad551c7c78ec
SSDEEP 3145728:0y6wK/3YQeljvSkvxD8S3iMTRj2U0hSko8v8OMQPi:0T5/INR5vCS3ikRgAko8UOnPi
TLSH
T15C48330AD7541AF9F0EB617889928835E772F972476497DF13600B7B6E633D08E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

70524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW ShowWindow

shell32

ShellExecuteW ShellExecuteExW

winhttp

WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect

kernel32

LeaveCriticalSection SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableW CreateFileW DeleteFileW FlushFileBuffers SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetLocalTime GetTickCount64 GetSystemDirectoryW GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW QueryFullProcessImageNameW MoveFileExW WideCharToMultiByte FreeConsole GetConsoleMode SetConsoleMode ReadConsoleInputW GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo GetConsoleScreenBufferInfoEx SetConsoleScreenBufferInfoEx SetConsoleTextAttribute WriteConsoleOutputW ReadConsoleOutputW SetConsoleTitleW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess GetCurrentProcessId InitializeSListHead GetFileSizeEx RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP ReadFile

Name

.text

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108.0MB

Virtual Size

108.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Spotify.exe

user32

shell32

winhttp

kernel32

generic

entry_nice.pyc