RewriterPad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RewriterPad.exe
Size 11.2MB
Sample261107-xmnd1aev41
SHA256 9bc4a06aeca12e27bfe7a059c218d156fb853b8a01227172ec0ed9fcb8100a6b
MD5 66f6185615bef5a39abed73403d35368
SHA1 8a4296a1abb197801a8ec88c501438d1f1eec7ad
SHA512 d2affd4d88ac199bd7097ef8f4341dc9fade5d7313c62dc0666186e2e09e73ae7fd0597bfe9ffae6e29356b6cf6d42716849001d6d0ec23dacb49a50736cb679
SSDEEP 98304:LcqOw9+3gjXW2mgpNycpB+QEIOye7xukFXxFviRUCJNNbS/ng7:JtocmRNyUI
TLSH
T11BC64A12F79795ACC45AC4B0835657336A3174CE0B35BAFF46C482782F79AE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RewriterPad.exe

File Explorer

RewriterPad.exe

.exe 11.2MB

RewriterPad.exe

IMPHASH 32d2f4a3f19aef189e316fcfce0a87e0
SHA256 9bc4a06aeca12e27bfe7a059c218d156fb853b8a01227172ec0ed9fcb8100a6b
MD5 66f6185615bef5a39abed73403d35368
SHA1 8a4296a1abb197801a8ec88c501438d1f1eec7ad
SHA512 d2affd4d88ac199bd7097ef8f4341dc9fade5d7313c62dc0666186e2e09e73ae7fd0597bfe9ffae6e29356b6cf6d42716849001d6d0ec23dacb49a50736cb679
SSDEEP 98304:LcqOw9+3gjXW2mgpNycpB+QEIOye7xukFXxFviRUCJNNbS/ng7:JtocmRNyUI
TLSH
T11BC64A12F79795ACC45AC4B0835657336A3174CE0B35BAFF46C482782F79AE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7520476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RewriterPad.pdb

kernel32

HeapAlloc GetProcessHeap LoadLibraryExA GlobalFree SetLastError LoadLibraryW HeapFree FormatMessageW GetModuleFileNameW FreeLibrary SetThreadErrorMode GetLastError GetProcAddress LoadLibraryExW Sleep GetModuleHandleA CloseHandle InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime GetFileAttributesW FreeEnvironmentStringsW CreateThread GetConsoleOutputCP GetStdHandle WriteConsoleW QueryPerformanceFrequency SleepEx ReadFileEx ExitProcess GetModuleHandleW GetFullPathNameW GetConsoleMode FindClose FindFirstFileExW GetFileInformationByHandle CreateFileW SwitchToThread GetFileInformationByHandleEx GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject DuplicateHandle SetFileInformationByHandle SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx GetCurrentProcess lstrlenW HeapReAlloc LoadLibraryA SetWaitableTimer CreateWaitableTimerExW GetCurrentThread MultiByteToWideChar RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo QueryPerformanceCounter WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW WideCharToMultiByte GlobalSize GlobalUnlock GlobalAlloc GlobalLock GetCurrentThreadId CompareStringOrdinal

user32

GetSystemMetrics SendMessageW CreateIconFromResourceEx DestroyWindow PeekMessageW TranslateMessage DispatchMessageW GetWindowLongPtrW GetClientRect RedrawWindow PostMessageW GetWindowPlacement GetClassNameW GetClassInfoExW IsWindowVisible RegisterClassExW CreateWindowExW ClientToScreen SetCursorPos GetForegroundWindow SetWindowPos InvalidateRgn FlashWindowEx LoadCursorW SetCursor ChangeDisplaySettingsExW SetWindowPlacement ReleaseDC GetPropW SetPropW SetWindowLongPtrW CallWindowProcW RemovePropW GetActiveWindow DefWindowProcW GetDC GetClipboardData RegisterClipboardFormatW CloseClipboard RegisterWindowMessageA SetCapture ReleaseCapture SystemParametersInfoA MonitorFromPoint EnumDisplayMonitors RegisterRawInputDevices MapVirtualKeyW MsgWaitForMultipleObjectsEx GetMonitorInfoW MonitorFromWindow GetCursorPos DestroyIcon DestroyCursor GetRawInputData SetWindowDisplayAffinity EmptyClipboard IsProcessDPIAware GetWindowRect IsIconic SetClipboardData ClipCursor ShowCursor ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW GetMenu AdjustWindowRectEx SendInput SetForegroundWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW RegisterTouchWindow ScreenToClient MonitorFromRect TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle ValidateRect MapVirtualKeyExW GetKeyboardState GetAsyncKeyState GetKeyState GetKeyboardLayout ToUnicodeEx OpenClipboard GetClipCursor IsClipboardFormatAvailable CreateIcon

gdi32

DeleteObject ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers CreateRectRgn GetDeviceCaps

uiautomationcore

UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaLookupId

oleaut32

VariantClear SafeArrayCreateVector SetErrorInfo GetErrorInfo SafeArrayPutElement SysAllocStringLen SysFreeString SysStringLen

ole32

RevokeDragDrop CoUninitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemFree CoCreateInstance OleInitialize RegisterDragDrop

shlwapi

AssocQueryStringW

shell32

DragQueryFileW DragFinish SHCreateItemFromParsingName

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

opengl32

wglDeleteContext wglShareLists wglGetCurrentContext wglGetProcAddress wglMakeCurrent wglGetCurrentDC wglCreateContext

advapi32

ImpersonateAnonymousToken RevertToSelf

imm32

ImmAssociateContextEx ImmGetContext ImmGetCompositionStringW ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

ntdll

NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile NtWriteFile

vcruntime140

__current_exception __current_exception_context memset __C_specific_handler _CxxThrowException __CxxFrameHandler3 memcpy memcmp memmove

api-ms-win-crt-math-l1-1-0

fmaf round pow floor sinf ceil log2 expf exp trunc ceilf powf fma floorf fmod _hypotf cosf atan2f acosf cbrtf exp2f log2f sin cos __setusermatherr roundf truncf

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit strerror __p___argc __p___argv _set_app_type _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _cexit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free