squalr[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
squalr.exe
Size 26.1MB
Sample261107-w73hzset3w
SHA256 c477812a9aa95628eb7647cf9d6367168cc4171aca915253d32f1be6110b7322
MD5 65cd8fa7d598f5667be18230c78f6b0b
SHA1 8433b8fcf3ee61656e268116900e0d86cc58f759
SHA512 bd2d004873cf0b77e6e7869002fa264d1d5a561a51d7cd33db31e7437040cf77297a686f9e04ab830a37febae3ba4852557e9b6128f79d3201f83da1d8c20a83
SSDEEP 196608:8YI1GYVykv0Sm6QHRB+RwYT1l4S37CiGQyc7DQ9:8YI1GYVybE1T1l4S37C1VcfQ
TLSH
T165572812BA5B989CD05AC8B083464A735A3134DB0B35B9FF65CC82792F6DBF05B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
squalr.exe

File Explorer

squalr.exe

.exe 26.1MB

squalr.exe

IMPHASH b8cc82456fc68b4be0e1a32d0012c5e6
SHA256 c477812a9aa95628eb7647cf9d6367168cc4171aca915253d32f1be6110b7322
MD5 65cd8fa7d598f5667be18230c78f6b0b
SHA1 8433b8fcf3ee61656e268116900e0d86cc58f759
SHA512 bd2d004873cf0b77e6e7869002fa264d1d5a561a51d7cd33db31e7437040cf77297a686f9e04ab830a37febae3ba4852557e9b6128f79d3201f83da1d8c20a83
SSDEEP 196608:8YI1GYVykv0Sm6QHRB+RwYT1l4S37CiGQyc7DQ9:8YI1GYVybE1T1l4S37C1VcfQ
TLSH
T165572812BA5B989CD05AC8B083464A735A3134DB0B35B9FF65CC82792F6DBF05B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18359292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

squalr.pdb

kernel32

WriteProcessMemory ReadProcessMemory VirtualProtectEx LoadLibraryExA VirtualQueryEx K32GetModuleInformation K32GetModuleFileNameExA K32EnumProcessModulesEx GetFileInformationByHandle ReleaseSemaphore ReadDirectoryChangesW CancelIo WaitForSingleObjectEx CreateSemaphoreW LocalAlloc FlushFileBuffers WriteFile DuplicateHandle GetCurrentProcess CreateFileW ExitProcess CreateProcessA LocalFree DeleteFileW OpenProcess ReadFile GetSystemInfo K32GetModuleFileNameExW FindNextFileW GetTempPathW GetFileAttributesW GetConsoleOutputCP WriteConsoleW ReleaseMutex LoadLibraryW CreateMutexA SwitchToThread FindClose FindFirstFileExW CopyFileExW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee IsWow64Process GetFullPathNameW IsWow64Process2 AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ReadFileEx SetHandleInformation CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeW WaitNamedPipeW SetNamedPipeHandleState GetCommandLineW GlobalMemoryStatusEx K32GetPerformanceInfo GetCurrentProcessId Process32NextW LoadLibraryA Process32FirstW SetWaitableTimer CreateWaitableTimerExW CreateToolhelp32Snapshot GetCurrentThread GlobalFree GlobalSize GlobalUnlock GetModuleHandleW GetFinalPathNameByHandleW SetLastError GlobalAlloc GlobalLock FormatMessageW GetProcessTimes GetExitCodeProcess GetSystemTimeAsFileTime WaitForSingleObject HeapFree GetSystemTimes HeapAlloc GetProcessHeap GetProcessIoCounters InitializeSListHead WideCharToMultiByte MultiByteToWideChar GetConsoleScreenBufferInfo GetConsoleMode SetConsoleTextAttribute lstrlenW GetStdHandle MoveFileExW GetFileInformationByHandleEx GetCurrentThreadId IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetTimeZoneInformationForYear Sleep GetModuleHandleA CloseHandle GetModuleFileNameW SetThreadErrorMode LoadLibraryExW FreeLibrary GetProcAddress GetLastError IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

combase

CoTaskMemFree

ole32

RevokeDragDrop RegisterDragDrop CoCreateFreeThreadedMarshaler CoUninitialize CoCreateInstance CoInitializeEx OleInitialize

oleaut32

GetErrorInfo SetErrorInfo VariantClear SafeArrayCreateVector SafeArrayPutElement SysAllocStringLen SysStringLen SysFreeString

shlwapi

AssocQueryStringW

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName ExtractIconW DragFinish DragQueryFileW CommandLineToArgvW ShellExecuteW

advapi32

SetSecurityDescriptorGroup GetSecurityDescriptorGroup SetSecurityDescriptorOwner GetSecurityDescriptorOwner SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl CryptAcquireContextW InitializeSecurityDescriptor CryptImportKey GetSecurityDescriptorControl SetSecurityDescriptorControl GetAclInformation GetLengthSid InitializeAcl AddAce OpenProcessToken GetTokenInformation GetSecurityDescriptorDacl IsValidSid FreeSid GetSidSubAuthorityCount GetSidLengthRequired CryptReleaseContext CopySid RevertToSelf ImpersonateAnonymousToken CryptDestroyKey GetAce

pdh

PdhRemoveCounter PdhCollectQueryData PdhEnumObjectsA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryA PdhCloseQuery

powrprof

CallNtPowerInformation

secur32

AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer EncryptMessage DecryptMessage DeleteSecurityContext

ntdll

RtlGetVersion NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtWriteFile NtQueryInformationProcess

psapi

GetModuleFileNameExW GetProcessMemoryInfo

user32

RemovePropW SystemParametersInfoA ToUnicodeEx CallWindowProcW GetMonitorInfoW GetWindowThreadProcessId SetWindowLongPtrW GetKeyboardLayout GetPropW SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx GetKeyState GetAsyncKeyState GetKeyboardState SetCursor LoadCursorW GetForegroundWindow SetCursorPos ClientToScreen InvalidateRgn SetWindowPos CreateWindowExW RegisterClassExW MapVirtualKeyExW DefWindowProcW GetClassInfoExW GetClassNameW GetWindowPlacement GetDC CreateIconFromResourceEx MonitorFromWindow TrackMouseEvent MonitorFromPoint DispatchMessageW TranslateMessage PeekMessageW SendMessageW GetSystemMetrics ScreenToClient GetActiveWindow GetClientRect ValidateRect EnumWindows GetRawInputData PostMessageW DestroyWindow IsWindowVisible ReleaseDC RedrawWindow SetCapture GetCursorPos EnumDisplayMonitors IsIconic GetWindowRect RegisterRawInputDevices EmptyClipboard SetWindowTextW MapVirtualKeyW MsgWaitForMultipleObjectsEx ShowWindow GetSystemMenu EnableMenuItem OpenClipboard IsClipboardFormatAvailable SetWindowLongW GetWindowLongW GetMenu DrawIconEx AdjustWindowRectEx RegisterWindowMessageA GetClipCursor GetWindowLongPtrW ReleaseCapture ClipCursor ShowCursor SetWindowDisplayAffinity DestroyIcon DestroyCursor CloseTouchInputHandle GetTouchInputInfo MonitorFromRect CreateIcon IsProcessDPIAware SendInput SetForegroundWindow GetWindowTextLengthW GetWindowTextW RegisterTouchWindow CloseClipboard RegisterClipboardFormatW GetClipboardData SetClipboardData SetPropW

gdi32

DeleteDC SwapBuffers SetPixelFormat ChoosePixelFormat CreateRectRgn DescribePixelFormat SelectObject CreateCompatibleDC GetDeviceCaps DeleteObject CreateDIBSection

uiautomationcore

UiaLookupId UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertDuplicateCertificateContext CertGetCertificateChain CryptStringToBinaryA CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateStore CertSetCertificateContextProperty CertFreeCertificateChain CertCreateCertificateContext CertDuplicateCertificateChain

opengl32

wglGetProcAddress wglCreateContext wglMakeCurrent wglGetCurrentContext wglGetCurrentDC wglDeleteContext wglShareLists

imm32

ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

ws2_32

setsockopt ioctlsocket recv send getpeername getaddrinfo closesocket WSAGetLastError WSACleanup WSAStartup connect freeaddrinfo select getsockopt WSASocketW

vcruntime140

__CxxFrameHandler3 memcpy memset memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context memcmp

api-ms-win-crt-math-l1-1-0

trunc cos powf pow round fma fmaf sin __setusermatherr exp2f ceilf sinf expf truncf floor roundf cbrtf acosf atan2f fmod log2 exp cosf ceil fmodf _hypotf log2f floorf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

strerror __p___argc __p___argv _cexit exit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _initialize_onexit_table _exit _register_onexit_function _crt_atexit terminate

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale