talok[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
talok.exe
Size 433KB
Sample261107-zad1xae13t
SHA256 805d60d8d339e3c50379b4ccb2bdc01eaa2cb20ec8f7033c4c7795cdb38d0931
MD5 cbda09254fe3cf8640e56778f608ce2b
SHA1 f0fc88064eb4d9d9b91017b31e8e6bc35c9d9902
SHA512 8518c5d2999f2c0b418eff390f6d1a1b5ea32ff1790dd5608e5d3c911835dc95e82f15317b6a3458fe99383e9f3e3eae25326d61206f140f718c9a1be310fe6e
SSDEEP 6144:R4AK6M+Bm4HYhgYSCzM9elv9AjFsM/N+Rs+JlOamWzxyiq7ShV9OGx:HKN+nOs+Jlp0iVhj
TLSH
T10E94AE09F7A254FAF6779138CEA3A507D6323C8A07609ACB37A845921F637D44E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
talok.exe

File Explorer

talok.exe

.exe 433KB

talok.exe

IMPHASH 247d344e255a346ed901f7783efa81d9
SHA256 805d60d8d339e3c50379b4ccb2bdc01eaa2cb20ec8f7033c4c7795cdb38d0931
MD5 cbda09254fe3cf8640e56778f608ce2b
SHA1 f0fc88064eb4d9d9b91017b31e8e6bc35c9d9902
SHA512 8518c5d2999f2c0b418eff390f6d1a1b5ea32ff1790dd5608e5d3c911835dc95e82f15317b6a3458fe99383e9f3e3eae25326d61206f140f718c9a1be310fe6e
SSDEEP 6144:R4AK6M+Bm4HYhgYSCzM9elv9AjFsM/N+Rs+JlOamWzxyiq7ShV9OGx:HKN+nOs+Jlp0iVhj
TLSH
T10E94AE09F7A254FAF6779138CEA3A507D6323C8A07609ACB37A845921F637D44E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\NIISI\cheats\TalokLauncher\build\release\talok.pdb

kernel32

WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar CreateFileMappingW MapViewOfFile UnmapViewOfFile OpenProcess DuplicateHandle GetCurrentProcess OpenEventW CreateDirectoryW GetUserDefaultUILanguage GetModuleFileNameW MoveFileExW CreateProcessW ExitProcess CreateMutexW WaitForSingleObject GetFileAttributesW DeleteFileW VirtualAlloc GetModuleHandleA LoadLibraryA GetProcAddress Sleep QueryPerformanceFrequency QueryPerformanceCounter ReadFile GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteFile SetFilePointer SetEndOfFile CreateFileW ReleaseMutex WriteConsoleW GetFileSize AllocConsole SetConsoleTitleW IsDebuggerPresent FlushFileBuffers ReadConsoleW HeapQueryInformation HeapSize GetStringTypeW SetStdHandle GetProcessHeap CloseHandle GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType HeapAlloc HeapFree FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx FormatMessageW GetModuleHandleW FreeEnvironmentStringsW GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead

user32

ShowWindow UpdateWindow PeekMessageW TranslateMessage DispatchMessageW DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW IsIconic GetKeyNameTextW GetClientRect PostMessageW MessageBoxW GetCursorPos SetWindowPos SetProcessDpiAwarenessContext GetSystemMetrics PostQuitMessage UnregisterClassW GetCursor LoadIconW GetKeyState CharUpperW MonitorFromWindow wsprintfW MapVirtualKeyExW GetMonitorInfoW ClientToScreen GetKeyboardLayout ToUnicodeEx LoadCursorW SetCursor

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoInitialize

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle

shlwapi

PathRemoveFileSpecW PathCombineW PathAppendW

dwmapi

DwmExtendFrameIntoClientArea

dwrite

DWriteCreateFactory

d3dcompiler_47

D3DCompile

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

talok.exe

kernel32

user32

shell32

ole32

d3d11

winhttp

shlwapi

dwmapi

dwrite

d3dcompiler_47

generic