notepad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
notepad.exe
Size 11.9MB
Sample261107-3bbtqage38
SHA256 ceafbeea65301f77a71e2bbf8d87c3d93fd5047a979084f81dbd3bb3bc7f49e3
MD5 633963e21f93a63df0d93aae444eeca9
SHA1 aa16446add7e4a4741a4b1f3617a73b68b6f56ed
SHA512 3ae6559e9fa51c4092f21e283fc39d61f121381a031a4a842c5eb71382913fa7d0879f9921cd0348769c6932d9e6c528de31f5e296e671d611f0a430e1a3e639
SSDEEP 98304:d32IooKXIE+XUDeLfeDt9ygF8Ut7w2w16tCSwKTYEygmYhC8aSl0wI+vCB2lmWE:lKXIE+XUDeLfeZ9ytUABoY8palh+vFQb
TLSH
T15BC65AE330C7A6EDC447C57A4313FD7F999F703A0626A8E75188A6326D26C943B25F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notepad.exe

File Explorer

notepad.exe

.exe 11.9MB

notepad.exe

IMPHASH ae67e904a4551f4b4121bb02c48a58e1
SHA256 ceafbeea65301f77a71e2bbf8d87c3d93fd5047a979084f81dbd3bb3bc7f49e3
MD5 633963e21f93a63df0d93aae444eeca9
SHA1 aa16446add7e4a4741a4b1f3617a73b68b6f56ed
SHA512 3ae6559e9fa51c4092f21e283fc39d61f121381a031a4a842c5eb71382913fa7d0879f9921cd0348769c6932d9e6c528de31f5e296e671d611f0a430e1a3e639
SSDEEP 98304:d32IooKXIE+XUDeLfeDt9ygF8Ut7w2w16tCSwKTYEygmYhC8aSl0wI+vCB2lmWE:lKXIE+XUDeLfeZ9ytUABoY8palh+vFQb
TLSH
T15BC65AE330C7A6EDC447C57A4313FD7F999F703A0626A8E75188A6326D26C943B25F09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3348512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken RegGetValueW RegSetKeyValueW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts

crypt32

CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CryptEncodeObject CryptProtectData CryptUnprotectData

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

shell32

SHGetKnownFolderPath ShellExecuteW

shlwapi

ord12

dwmapi

DwmSetWindowAttribute

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSAStartup accept bind closesocket getsockname htonl listen ntohs recv select send setsockopt socket

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CancelIoEx CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateNamedPipeA CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetOEMCP GetOverlappedResult GetPackageId GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemFirmwareTable GetSystemTimeAsFileTime GetThreadContext GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetProcessMitigationPolicy SetStdHandle SetThreadInformation SetUnhandledExceptionFilter SleepConditionVariableSRW SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetClientRect GetClipboardData GetDpiForSystem GetDpiForWindow GetKeyState GetSystemMetrics GetWindowLongPtrW LoadCursorW MessageBoxA MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW ReleaseCapture ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetProcessDpiAwarenessContext SetWindowDisplayAffinity SetWindowLongPtrW SetWindowPos ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

d3dcompiler_47

D3DCompile

imm32

ImmGetCompositionStringW ImmGetContext ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

321B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.FOID

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FOID

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

notepad.exe

advapi32

winhttp

crypt32

ole32

shell32

shlwapi

dwmapi

version

ws2_32

d3d11

kernel32

user32

d3dcompiler_47

imm32

generic