puw_notch[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
puw_notch.exe
Size 901KB
Sample261110-ynbx2aaf53
SHA256 f4c28e49060f95b892c357c471b8213a4ba24f8966d8d0fbd1c31dc57e9cd30d
MD5 6eb09a2a7c659b46229144c73e733f0e
SHA1 d6163744bb3109411ec69086058eb9dbec5b170c
SHA512 4e0d10d379b7396595b2d09e0a2ce7433dd1614e5c24b58cf1bf0b99ee8d1cf0a5a40d59fed3cb138b7b72ed85b83fd5d674878085a1277c7b79c0e7dcd81b9c
SSDEEP 12288:If9RkNAL2oTk/ocHVrPDkhkpDEV778KW0+o/soKKQxGlcc7MhRjg:In2oTkocHVvkeDEV779Wo0oKIllY
TLSH
T13D156C03E3A480E8D499C078A75AE537E632F8CD4A3575EB1BE41B112FA5F909F2D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
puw_notch.exe

File Explorer

puw_notch.exe

.exe 901KB

puw_notch.exe

IMPHASH 7cc83104ea23264ba70bae39711f4f03
SHA256 f4c28e49060f95b892c357c471b8213a4ba24f8966d8d0fbd1c31dc57e9cd30d
MD5 6eb09a2a7c659b46229144c73e733f0e
SHA1 d6163744bb3109411ec69086058eb9dbec5b170c
SHA512 4e0d10d379b7396595b2d09e0a2ce7433dd1614e5c24b58cf1bf0b99ee8d1cf0a5a40d59fed3cb138b7b72ed85b83fd5d674878085a1277c7b79c0e7dcd81b9c
SSDEEP 12288:If9RkNAL2oTk/ocHVrPDkhkpDEV778KW0+o/soKKQxGlcc7MhRjg:In2oTkocHVvkeDEV779Wo0oKIllY
TLSH
T13D156C03E3A480E8D499C078A75AE537E632F8CD4A3575EB1BE41B112FA5F909F2D718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

730048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

puw_notch.pdb

kernel32

LoadLibraryW SetProcessWorkingSetSize GetUserDefaultGeoName GetCurrentProcess ConnectNamedPipe SetEvent GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime QueryFullProcessImageNameW DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile FindClose GetLastError GetModuleHandleW WaitForMultipleObjects GetSystemTime FindNextChangeNotification GetSystemPowerStatus GetCurrentThread FormatMessageW HeapAlloc HeapFree GetProcessHeap SwitchToThread FindCloseChangeNotification GetProcAddress SetFileInformationByHandle MoveFileExW SetProcessInformation CreateMutexW GetTickCount GetLocalTime WaitForSingleObject OpenProcess SetThreadPriority GetExitCodeProcess GetCurrentProcessId Process32NextW Process32FirstW CreateToolhelp32Snapshot FindFirstChangeNotificationW SetThreadStackGuarantee GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte SetLastError MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber SetFilePointerEx CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW GetModuleFileNameW GetTempPathW DeleteFileW CreateWaitableTimerExW SetWaitableTimer Sleep FindNextFileW CreateEventW LoadLibraryExA FreeLibrary CreateNamedPipeW CloseHandle SetUnhandledExceptionFilter AddVectoredExceptionHandler InitializeSListHead HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

oleaut32

SysStringLen SysFreeString GetErrorInfo VariantClear SetErrorInfo SysAllocStringLen

ole32

CoCreateFreeThreadedMarshaler CoUninitialize CoIncrementMTAUsage CoInitializeEx CoCreateInstance CoTaskMemFree

shell32

ShellExecuteW Shell_NotifyIconW SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteExW SHQueryUserNotificationState

gdi32

DeleteObject CreateRectRgn

advapi32

RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteKeyValueW RegSetKeyValueW ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegGetValueW

dwmapi

DwmFlush

user32

GetDpiForWindow GetClientRect IsWindowEnabled GetClassNameW ReleaseCapture SendInput EnumWindows IsWindow GetMonitorInfoW MonitorFromPoint MessageBoxW DestroyWindow GetCursorPos KillTimer CallNextHookEx DestroyMenu TrackPopupMenu SetCapture TrackMouseEvent SetCursor GetKeyState EnumChildWindows GetAsyncKeyState PostMessageW FindWindowExW IsIconic IsWindowVisible GetCapture SetFocus SetForegroundWindow SetWindowLongPtrW GetWindowLongPtrW GetForegroundWindow SendMessageTimeoutW SetWindowRgn GetWindow AppendMenuW FindWindowW LoadCursorW LoadIconW LoadImageW GetSystemMetrics DefWindowProcW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW SetTimer SetWinEventHook ShowWindow RegisterDeviceNotificationW SetWindowsHookExW RegisterPowerSettingNotification RegisterWindowMessageW CreateWindowExW RegisterClassExW SetProcessDpiAwarenessContext GetLastInputInfo AllowSetForegroundWindow SetWindowPos GetWindowRect CreatePopupMenu GetWindowTextW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError NtQueryInformationProcess

d3d11

D3D11CreateDevice

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetOpenW InternetSetOptionW InternetCloseHandle InternetOpenUrlW HttpQueryInfoW InternetReadFile

dcomp

DCompositionCreateDevice

cfgmgr32

CM_Get_DevNode_PropertyW CM_Locate_DevNodeW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

bcryptprimitives

ProcessPrng

vcruntime140

memset memmove memcpy __CxxFrameHandler3 memcmp __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

powf __setusermatherr expf roundf floor round sinf fmodf truncf floorf ceilf cosf sin

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _crt_atexit _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function terminate _c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free