atapiro[.]xd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
atapiro.xd.exe
Size 1.4MB
Sample261107-qzrhvsct71
SHA256 cbbaf062169f366361a79387f332f68bc1823f03374c97814f635de9a037dded
MD5 93f24c63195edd4ac8be2e6d1216667c
SHA1 832d862e6309e49d8818bdb8ea1faec1eb74458e
SHA512 34da647281113f1ead029a76c9ce0389cda3d4f25411423d78634b49ac24c7fe4dae745db399e3bc45affcf469cb750c27afbca2220093d5f7d078878f98f740
SSDEEP 24576:qozdlCQQjMHnRzhvq6rBCCASBQFpJG/yLRXBi5n1f9F:qElCQQoVBCCASBYJGI+5n3
TLSH
T1F865AE03F3A401ECD07BD178C996AA1BEB767805073459DF13E18A592F736E05ABBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atapiro.xd.exe

File Explorer

atapiro.xd.exe

.exe 1.4MB

atapiro.xd.exe

IMPHASH 3363852ccef24c0694a2c734237e0b51
SHA256 cbbaf062169f366361a79387f332f68bc1823f03374c97814f635de9a037dded
MD5 93f24c63195edd4ac8be2e6d1216667c
SHA1 832d862e6309e49d8818bdb8ea1faec1eb74458e
SHA512 34da647281113f1ead029a76c9ce0389cda3d4f25411423d78634b49ac24c7fe4dae745db399e3bc45affcf469cb750c27afbca2220093d5f7d078878f98f740
SSDEEP 24576:qozdlCQQjMHnRzhvq6rBCCASBQFpJG/yLRXBi5n1f9F:qElCQQoVBCCASBYJGI+5n3
TLSH
T1F865AE03F3A401ECD07BD178C996AA1BEB767805073459DF13E18A592F736E05ABBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

838416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Aras\Downloads\clientautomap - Kopya (2)\bin\x64\Release\atapiro.xd.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

kernel32

InterlockedPushEntrySList GetCurrentProcess GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle ReadProcessMemory GetModuleHandleW GetTickCount SetUnhandledExceptionFilter GetExitCodeProcess WriteProcessMemory GetEnvironmentVariableA Module32FirstW Module32NextW CreateDirectoryA VirtualQueryEx GetTickCount64 ExitProcess DuplicateHandle GetModuleHandleA GetProcAddress WaitForSingleObject GetLastError OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter FindFirstFileA FindNextFileA FindClose DeleteFileA RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry FlsGetValue FreeLibraryAndExitThread GetModuleHandleExW ReadFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetFileType GetConsoleMode ReadConsoleW GetTimeZoneInformation FlushFileBuffers ExitThread GetConsoleOutputCP CreateDirectoryW IsValidCodePage GetACP GetOEMCP FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap FlsSetValue FlsFree CreateThread FindNextFileW SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW RtlUnwind SetEvent CreateEventW HeapReAlloc SetLastError GetCommandLineA GetCommandLineW FindFirstFileExW IsProcessorFeaturePresent FlsAlloc GetEnvironmentStringsW

user32

GetAsyncKeyState SetProcessDPIAware GetCursorPos DestroyWindow IsIconic GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendInput GetWindowThreadProcessId DefWindowProcW GetWindow IsWindowUnicode IsWindowVisible SetWindowPos CreateWindowExW ScreenToClient GetSystemMetrics GetClassNameA RegisterClassExW ShowWindow IsWindow DispatchMessageW ClientToScreen PeekMessageW GetForegroundWindow EnumWindows SetLayeredWindowAttributes TranslateMessage LoadCursorW GetClientRect PostQuitMessage SetForegroundWindow

shell32

ShellExecuteW

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CreateStreamOnHGlobal

winmm

timeEndPeriod timeBeginPeriod

ws2_32

send getpeername WSAStartup closesocket WSAGetLastError

iphlpapi

GetExtendedTcpTable

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

gdiplus

GdipCreateBitmapFromStream GdipAlloc GdipBitmapUnlockBits GdipDisposeImage GdipFree GdipGetImageWidth GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipBitmapLockBits

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive WaitForSingleObjectEx AcquireSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread GetCurrentProcessId GetStartupInfoW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

342KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

atapiro.xd.exe

d3d11

d3dcompiler_47

dwmapi

wininet

kernel32

user32

shell32

ole32

winmm

ws2_32

iphlpapi

imm32

gdiplus

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic