RewriterPad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RewriterPad.exe
Size 11.1MB
Sample261107-xmlv6sev4z
SHA256 5c3852fbab3863719c382c3e764b882f31af61d2f48392528c1cb9880717a069
MD5 bad1b989ef816308a40c7db44777c259
SHA1 0aa4d643aa8995d578d1309ad3ff7bbcbfbdebe5
SHA512 200026cc8e74ba199d8a2c1cd1d95a8219c574b43aac8c6848194c28817bf6f15b80613a5d4fff0575e5673eda27200a10c31498466313a6009a9402338a194f
SSDEEP 98304:4sTQbf1I5TjRm7w5xt4KxxX860S2Uc8t2FJNJLFPjL14bqqoYk:kOmwtjhaN
TLSH
T10BC65A02F79699ACC45AC4B0935697336A3174CE0B35B9FF46C492342F79BE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RewriterPad.exe

File Explorer

RewriterPad.exe

.exe 11.1MB

RewriterPad.exe

IMPHASH aecf786cb6b58bd667bc8b8227b14ec4
SHA256 5c3852fbab3863719c382c3e764b882f31af61d2f48392528c1cb9880717a069
MD5 bad1b989ef816308a40c7db44777c259
SHA1 0aa4d643aa8995d578d1309ad3ff7bbcbfbdebe5
SHA512 200026cc8e74ba199d8a2c1cd1d95a8219c574b43aac8c6848194c28817bf6f15b80613a5d4fff0575e5673eda27200a10c31498466313a6009a9402338a194f
SSDEEP 98304:4sTQbf1I5TjRm7w5xt4KxxX860S2Uc8t2FJNJLFPjL14bqqoYk:kOmwtjhaN
TLSH
T10BC65A02F79699ACC45AC4B0935697336A3174CE0B35B9FF46C492342F79BE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7459804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RewriterPad.pdb

kernel32

HeapAlloc GetProcessHeap LoadLibraryExA GlobalFree SetLastError LoadLibraryW HeapFree FormatMessageW GetModuleFileNameW FreeLibrary SetThreadErrorMode GetLastError LoadLibraryExW GetProcAddress Sleep GetModuleHandleA CloseHandle InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime GetFileAttributesW FreeEnvironmentStringsW CreateThread GetConsoleOutputCP GetStdHandle WriteConsoleW QueryPerformanceFrequency SleepEx ReadFileEx ExitProcess GetModuleHandleW GetFullPathNameW GetConsoleMode FindClose FindFirstFileExW GetFileInformationByHandle CreateFileW SwitchToThread GetFileInformationByHandleEx GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject DuplicateHandle SetFileInformationByHandle SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx GetCurrentProcess lstrlenW HeapReAlloc LoadLibraryA SetWaitableTimer CreateWaitableTimerExW GetCurrentThread MultiByteToWideChar RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo QueryPerformanceCounter WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW WideCharToMultiByte GlobalSize GlobalUnlock GlobalAlloc GlobalLock GetCurrentThreadId CompareStringOrdinal

user32

GetActiveWindow GetSystemMetrics SendMessageW CreateIconFromResourceEx DestroyWindow PeekMessageW TranslateMessage DispatchMessageW GetWindowLongPtrW GetClientRect ReleaseDC GetDC GetWindowPlacement GetClassNameW IsWindowVisible DefWindowProcW RegisterClassExW CreateWindowExW ClientToScreen SetCursorPos GetForegroundWindow SetWindowPos InvalidateRgn FlashWindowEx LoadCursorW SetCursor ChangeDisplaySettingsExW SetWindowPlacement PostMessageW GetPropW SetPropW SetWindowLongPtrW CallWindowProcW RemovePropW GetClassInfoExW RedrawWindow GetClipboardData RegisterClipboardFormatW CloseClipboard RegisterWindowMessageA SetCapture ReleaseCapture SystemParametersInfoA MonitorFromPoint EnumDisplayMonitors RegisterRawInputDevices MapVirtualKeyW MsgWaitForMultipleObjectsEx GetMonitorInfoW MonitorFromWindow GetCursorPos DestroyIcon DestroyCursor GetRawInputData SetWindowDisplayAffinity IsProcessDPIAware GetWindowRect EmptyClipboard GetClipCursor ClipCursor ShowCursor SetClipboardData GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW GetMenu AdjustWindowRectEx SendInput SetForegroundWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW RegisterTouchWindow CreateIcon ScreenToClient MonitorFromRect TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle ValidateRect MapVirtualKeyExW GetKeyboardState GetAsyncKeyState GetKeyState GetKeyboardLayout ToUnicodeEx OpenClipboard ShowWindow IsClipboardFormatAvailable IsIconic

gdi32

DeleteObject ChoosePixelFormat CreateRectRgn SetPixelFormat GetDeviceCaps DescribePixelFormat SwapBuffers

uiautomationcore

UiaLookupId UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysAllocStringLen SysStringLen VariantClear GetErrorInfo SetErrorInfo SysFreeString

ole32

CoInitializeEx RevokeDragDrop CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree CoUninitialize RegisterDragDrop OleInitialize

shlwapi

AssocQueryStringW

shell32

DragQueryFileW DragFinish SHCreateItemFromParsingName

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

opengl32

wglGetProcAddress wglShareLists wglGetCurrentDC wglGetCurrentContext wglMakeCurrent wglDeleteContext wglCreateContext

advapi32

ImpersonateAnonymousToken RevertToSelf

imm32

ImmAssociateContextEx ImmGetContext ImmGetCompositionStringW ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile

vcruntime140

__current_exception __current_exception_context memcpy __C_specific_handler _CxxThrowException __CxxFrameHandler3 memmove memcmp memset

api-ms-win-crt-math-l1-1-0

round pow expf floor fmaf ceil exp log2 trunc floorf sinf fmod fma ceilf _hypotf cosf atan2f acosf cos cbrtf exp2f truncf powf log2f sin __setusermatherr roundf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _set_app_type _register_thread_local_exe_atexit_callback strerror _initialize_onexit_table _register_onexit_function _crt_atexit terminate _c_exit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free