Paint3D[.]exe | Triage™

Target
Paint3D.exe
Size 371KB
Sample261102-s8f5labs5v
SHA256 5e582eb30eca69ca9ad9f64d66a0b2ba3fd18388eafcbadf48cfd3268dd44e7d
MD5 118038b74810d782ec03a39fdff2c5e6
SHA1 abb88c8fb0775b02487559968c7eb4be915e0545
SHA512 431c516852b976b3209b37b2f098b25988399031a3ea10acf89e2ac7e04ed4a9de911779ded87868835f2201e26c7d9103d9a62fc68709c81662b4ee7d80049b
SSDEEP 6144:1IrgjpORUeiq4puRcZ27WJE/brQLjkW4nnTe8gfDdx:1ggliQq4ESZ2qkkjkFnnTeXDdx
TLSH
T13C847D82BB86ECEBD605423589AB53153738F2E107935F171D28B2341E17AF1BE8761B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Paint3D.exe

File Explorer

Paint3D.exe

.exe 371KB

Paint3D.exe

IMPHASH df9abbbdca4eec31cbda4fbaab75ae8a
SHA256 5e582eb30eca69ca9ad9f64d66a0b2ba3fd18388eafcbadf48cfd3268dd44e7d
MD5 118038b74810d782ec03a39fdff2c5e6
SHA1 abb88c8fb0775b02487559968c7eb4be915e0545
SHA512 431c516852b976b3209b37b2f098b25988399031a3ea10acf89e2ac7e04ed4a9de911779ded87868835f2201e26c7d9103d9a62fc68709c81662b4ee7d80049b
SSDEEP 6144:1IrgjpORUeiq4puRcZ27WJE/brQLjkW4nnTe8gfDdx:1ggliQq4ESZ2qkkjkFnnTeXDdx
TLSH
T13C847D82BB86ECEBD605423589AB53153738F2E107935F171D28B2341E17AF1BE8761B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

comdlg32

ChooseColorA GetSaveFileNameA

gdi32

Arc BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontA CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse ExtFloodFill GetPixel GetStockObject LineTo MoveToEx Polygon Polyline Rectangle SelectObject SetBkMode SetTextColor TextOutA

kernel32

DeleteCriticalSection EnterCriticalSection GetLastError GetModuleHandleW GetProcAddress GetStartupInfoA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MultiByteToWideChar SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _ismbblead _lock _onexit _unlock abort calloc exit fclose fopen fprintf fputc free fwrite localeconv malloc memcpy memmove memset realloc signal strerror strlen strncmp vfprintf wcslen

user32

BeginPaint CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint FillRect GetDC GetDlgCtrlID GetMessageA GetWindow GetWindowTextA InvalidateRect LoadCursorA LoadIconA MessageBoxA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC SendMessageA SetCapture ShowWindow TranslateMessage UpdateWindow

libssp-0

__stack_chk_fail __stack_chk_guard

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

925B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Paint3D.exe

comctl32

comdlg32

gdi32

kernel32

msvcrt

user32

libssp-0

generic