EasyMacro[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EasyMacro.exe
Size 105KB
Sample261110-ynhetaaf59
SHA256 08f373b55c207c6c92683f48c336e867c6a12ca3aced905f5c77f2bb26d8a28a
MD5 9493bd45f1517f0763479f5ec7739259
SHA1 47bc00f10170823e531654298f12a85fe12cb033
SHA512 a7139fb3161a2c7d226abb2b93c3058e35b444b882358868ae762eccd69452afbe09a2058faaeaa757604b0c50a004c2f576a58719fce528bd379e1bc0f74590
SSDEEP 1536:pVB/x351csKvpd5/5BmCl11111h1111xSCEX1fguxMTqm+4ok+j:F18ZvpTvXSbXOBGme
TLSH
T173B3F9E1D78751E2F89A5871CC338D4BDDB1FD81A8A95A1F01683A1D5E3B732980B327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EasyMacro.exe

File Explorer

EasyMacro.exe

.exe 105KB

EasyMacro.exe

IMPHASH 216ce92f52b38f5b9c6f96ce7160c561
SHA256 08f373b55c207c6c92683f48c336e867c6a12ca3aced905f5c77f2bb26d8a28a
MD5 9493bd45f1517f0763479f5ec7739259
SHA1 47bc00f10170823e531654298f12a85fe12cb033
SHA512 a7139fb3161a2c7d226abb2b93c3058e35b444b882358868ae762eccd69452afbe09a2058faaeaa757604b0c50a004c2f576a58719fce528bd379e1bc0f74590
SSDEEP 1536:pVB/x351csKvpd5/5BmCl11111h1111xSCEX1fguxMTqm+4ok+j:F18ZvpTvXSbXOBGme
TLSH
T173B3F9E1D78751E2F89A5871CC338D4BDDB1FD81A8A95A1F01683A1D5E3B732980B327
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileSize ReadFile WriteFile HeapAlloc CreateMutexW CreateFileW GetModuleFileNameW MoveFileExW MultiByteToWideChar WideCharToMultiByte GetLastError CloseHandle DeleteFileW CreateDirectoryW GetEnvironmentVariableW lstrcatW lstrcpynW CompareStringOrdinal lstrlenW lstrcpyW lstrcmpiW MulDiv SetProcessWorkingSetSize LoadLibraryExW GetProcAddress GetModuleHandleW GetTickCount ExitProcess GetProcessHeap GetCurrentProcess HeapFree GetCommandLineW

user32

BeginPaint EndPaint AdjustWindowRectExForDpi SetCursor GetCursorPos TrackPopupMenuEx GetWindowThreadProcessId LoadCursorW LoadImageW MonitorFromPoint GetMonitorInfoW GetDpiForWindow ChangeWindowMessageFilterEx TrackMouseEvent SendMessageW SetFocus GetFocus GetKeyState GetCapture SetCapture ReleaseCapture UpdateWindow GetDC ReleaseDC InvalidateRect SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect ScreenToClient AllowSetForegroundWindow PtInRect DrawTextW RegisterHotKey UnregisterHotKey CharUpperW GetAsyncKeyState GetKeyNameTextW SendInput MapVirtualKeyW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsIconic IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW GetMessageTime DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW SetForegroundWindow IntersectRect wsprintfW SetMenuDefaultItem FindWindowW

gdi32

CreateFontIndirectW DeleteObject EnumFontFamiliesExW SelectObject SetBkColor SetTextColor GetTextMetricsW BitBlt CreateCompatibleDC CreateRectRgnIndirect DeleteDC GetTextExtentPoint32W SelectClipRgn SetBkMode CreateDIBSection GdiFlush CreateSolidBrush

shell32

Shell_NotifyIconW

advapi32

RegGetValueW RegDeleteKeyValueW RegSetKeyValueW

dwmapi

DwmSetWindowAttribute