macro-tui-x86_64-pc-windows-msvc[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
macro-tui-x86_64-pc-windows-msvc.zip
Size 2.3MB
Sample261110-gmgnfsdc36
SHA256 8763626b227e4809472ff3f624e68e3afa4eaa172f5f2daa9c91e56d0d55b763
MD5 cea1312314ed550621564005aa4fc7f0
SHA1 e539faaf2e0f83076eb7ef2d2793449910ed3159
SHA512 30fc47fa17818a1001967ac93fce6b13dbb1847cbe970cbddc6c22a8700f02ed8375b8cd63df84eb23d84496fdce0b1d39f795fa11a0fc2314316c834f96dc89
SSDEEP 49152:FH5YUA0M9cPnrPY8MGzyoqJLDYT8/oRSIMB1a7TAID/gRN854mk6aVy9:FH6l9YnrPY8MkqJ/YIzfunCNCrGQ9
TLSH
T13AB5330821602439CB97C48936E9AE85B374FE640B92715B0C73E9E2DED25F72BB71D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/macro-tui.exe

File Explorer

macro-tui-x86_64-pc-windows-msvc.zip

.zip 2.3MB
macro-tui.exe

.exe 5.0MB

macro-tui-x86_64-pc-windows-msvc.zip

SHA256 8763626b227e4809472ff3f624e68e3afa4eaa172f5f2daa9c91e56d0d55b763
MD5 cea1312314ed550621564005aa4fc7f0
SHA1 e539faaf2e0f83076eb7ef2d2793449910ed3159
SHA512 30fc47fa17818a1001967ac93fce6b13dbb1847cbe970cbddc6c22a8700f02ed8375b8cd63df84eb23d84496fdce0b1d39f795fa11a0fc2314316c834f96dc89
SSDEEP 49152:FH5YUA0M9cPnrPY8MGzyoqJLDYT8/oRSIMB1a7TAID/gRN854mk6aVy9:FH6l9YnrPY8MkqJ/YIzfunCNCrGQ9
TLSH
T13AB5330821602439CB97C48936E9AE85B374FE640B92715B0C73E9E2DED25F72BB71D1
MD5 SHA1 SHA512 SSDEEP TLSH

macro-tui.exe

IMPHASH f2eefeb7f833b71d6b821c02673eac7a
SHA256 3cb11652712300a37c8d6722896ed2470cf21087741542c54d02ea985fd2b385
MD5 e3b1e46f2d57b382cd57bcb4b6a41cc7
SHA1 f2553621e6dcecfc029cf773dc0cb7016c01a5e5
SHA512 501e30f7211e6cc77392ceef679aad64b6bae37dbd1f3bd006860fac75e1b4008e0f217d5e4ce512aff9bd02797e7dcd41f65e5820329af98b3d3af4071c6b16
SSDEEP 49152:wTgMgOXLEa+fIKukU2/tt+5bOKtObUybK3FYQwhQYBaqRjOpPtKZ59Z0zmIYZ56u:wiABOfK3CxBWPyQzmuMTH+iyg3
TLSH
T1D5363A12BA5B98ECD15AC87483468A735E2174DB0B26B9FF00C456393F6ABE01F3C759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3602336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

macro_tui.pdb

kernel32

SetConsoleCursorInfo GetProcAddress GetModuleHandleA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryA GetTimeZoneInformationForYear FindFirstFileExW FindClose SetFileInformationByHandle SetFileTime GetFullPathNameW SetHandleInformation IsThreadAFiber FlsSetValue FlsFree FlsAlloc WriteConsoleW GetFileInformationByHandle GetConsoleOutputCP GetCurrentThreadId GetFileInformationByHandleEx Sleep CreateDirectoryW WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus ReleaseSemaphore GetFinalPathNameByHandleW ExitProcess GetQueuedCompletionStatusEx GetTempPathW CreateSemaphoreW CreateFileW FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorPosition ReadConsoleInputW GetNumberOfConsoleInputEvents WaitForMultipleObjects CreateWaitableTimerExW CreateThread SwitchToThread WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx MultiByteToWideChar SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle GetCurrentThread SetThreadStackGuarantee lstrlenW CancelIoEx CloseHandle GetFileType WaitForSingleObject SetConsoleActiveScreenBuffer CreateConsoleScreenBuffer SetConsoleMode GetConsoleMode SetLastError GetLastError SetWaitableTimer GetModuleFileNameW GetSystemInfo HeapReAlloc AddVectoredExceptionHandler GetSystemTimeAsFileTime GlobalAlloc SetUnhandledExceptionFilter GlobalLock HeapFree GetSystemTimePreciseAsFileTime FormatMessageW GetCurrentDirectoryW GetModuleHandleW GetModuleHandleExW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetCommandLineW GetProcessHeap GlobalUnlock InitializeSListHead

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

NtCreateFile NtReadFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

advapi32

ImpersonateAnonymousToken RevertToSelf SystemFunction036

ws2_32

WSAStartup getsockopt connect bind WSACleanup ioctlsocket WSASocketW closesocket recv setsockopt getaddrinfo freeaddrinfo send getsockname WSAGetLastError getpeername shutdown WSASend WSAIoctl

bcryptprimitives

ProcessPrng

user32

GetForegroundWindow SetClipboardData GetKeyboardLayout EmptyClipboard OpenClipboard GetWindowThreadProcessId CloseClipboard RegisterClipboardFormatW ToUnicodeEx

gdi32

DeleteObject

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception memcpy memcmp memmove memset _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

__setusermatherr round truncf pow floorf ceilf roundf

api-ms-win-crt-runtime-l1-1-0

__p___argc _configure_narrow_argv _initialize_narrow_environment __p___argv _exit exit _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback terminate _cexit strerror _seh_filter_exe _set_app_type _c_exit _get_initial_narrow_environment _crt_atexit _initterm _initterm_e

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode