px[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
px.exe
Size 1.0MB
Sample261107-rl4rpsyv6k
SHA256 a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4
MD5 18126be163eb7df2194bb902c359ba8e
SHA1 6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40
SHA512 4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5
SSDEEP 24576:hddWiFqQmrV7vFiceltK2suv23bHqXi8xZFRw6AcYtLfMzLtoJ9DmbxZSm:DdWOthnv232iJ4pY9Dm9L
TLSH
T11E357D5677A402F5D17BE239CA624A16E9727C064B31E74F03A842BA0F237615E7F732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

px.exe

.exe 1.0MB

px.exe

IMPHASH 23ec691d842c955a20a733a38e68ed25
SHA256 a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4
MD5 18126be163eb7df2194bb902c359ba8e
SHA1 6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40
SHA512 4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5
SSDEEP 24576:hddWiFqQmrV7vFiceltK2suv23bHqXi8xZFRw6AcYtLfMzLtoJ9DmbxZSm:DdWOthnv232iJ4pY9Dm9L
TLSH
T11E357D5677A402F5D17BE239CA624A16E9727C064B31E74F03A842BA0F237615E7F732
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

0f:d4:76:40:11:21:77:7d:86:21:dc:79:0e:7a:c1:72:68:7e:8a:e8:88:ac:99:ed:d8:e3:55:7e:fb:14:33:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 12, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

43396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\psexec\exe\x64\Release\psexec64.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetServerEnum NetApiBufferFree

ws2_32

gethostbyname WSAStartup gethostname inet_ntoa

mpr

WNetAddConnection2W WNetCancelConnection2W

kernel32

CreateEventW GetEnvironmentVariableW GetFullPathNameW SetFileAttributesW GetFileAttributesW CopyFileW WaitNamedPipeW SetConsoleCtrlHandler SetConsoleTitleW ReadConsoleW TransactNamedPipe SetProcessAffinityMask FindFirstFileExA FindClose WaitForSingleObjectEx OutputDebugStringW OutputDebugStringA GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetNamedPipeHandleState DisconnectNamedPipe DuplicateHandle GetFileTime WaitForMultipleObjects GetExitCodeProcess ResumeThread FindNextFileA GetCurrentProcessId GetVersion GetCurrentThread ReadFile GetConsoleScreenBufferInfo MultiByteToWideChar VerifyVersionInfoW GetComputerNameW DeleteFileW CreateFileW GetSystemDirectoryW FindResourceW ConnectNamedPipe FormatMessageA GetTickCount CloseHandle WriteFile SizeofResource LoadResource RtlUnwind Sleep WaitForSingleObject SetEvent GetLastError GetCurrentProcess FreeLibrary LockResource VerSetConditionMask SetPriorityClass GetModuleFileNameW GetCommandLineW GetModuleHandleW GetStdHandle GetFileType LocalFree LocalAlloc GetProcAddress GetVersionExW LoadLibraryExW SetLastError FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetFilePointerEx HeapSize HeapReAlloc SetEndOfFile FindFirstFileExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetConsoleMode GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode SetStdHandle CreateThread ExitThread FreeLibraryAndExitThread GetStringTypeW GetModuleFileNameA WideCharToMultiByte GetCommandLineA GetACP HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

user32

GetDlgItem EndDialog SetWindowTextW SendMessageW SetCursor GetSysColorBrush LoadStringW InflateRect LoadCursorW DialogBoxIndirectParamW

gdi32

StartPage EndDoc StartDocW SetMapMode GetDeviceCaps EndPage

comdlg32

PrintDlgW

advapi32

SetEntriesInAclW CreateProcessAsUserW OpenThreadToken ImpersonateNamedPipeClient CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptImportKey CryptExportKey CryptDestroyKey CryptDeriveKey CryptGenKey CryptReleaseContext CryptAcquireContextW StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegConnectRegistryW ImpersonateLoggedOnUser LogonUserW AdjustTokenPrivileges OpenProcessToken RevertToSelf LsaEnumerateAccountRights LsaOpenPolicy LsaClose LsaFreeMemory SetSecurityInfo GetSecurityInfo LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce InitializeAcl GetLengthSid FreeSid AllocateAndInitializeSid SetTokenInformation GetTokenInformation RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey