1XygiGG (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1XygiGG (1).exe
Size 2.4MB
Sample261113-zwlymsgw5w
SHA256 3945cbb79c4cc6de6301c32cd147bffdd2cca32917f6166a0394e990335379c8
MD5 1717eba5d6cfbd4814ca20c186bd829e
SHA1 8fce7bb92d4773fe6e9ab561bcced2b64461bbff
SHA512 9e85802598fbd76f48cf57da9d952dc0b4daf214d24ff1e1b9fc5ae7ca875fa883b1742193be33de7025a0a53e388c19336b4475e635579bd2ebbac76c27440e
SSDEEP 24576:C5eaRTFaujMmOFB+mJtmzBXkCacIINFYS:q/5M/JtmrrG
TLSH
T114B5C81BEBB610D5E0BAC13CD553222AFC7134A6833897DBA6C59E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1XygiGG (1).exe

File Explorer

1XygiGG (1).exe

.exe 2.4MB

1XygiGG (1).exe

IMPHASH 230fb3107122652842b61f42a87d304f
SHA256 3945cbb79c4cc6de6301c32cd147bffdd2cca32917f6166a0394e990335379c8
MD5 1717eba5d6cfbd4814ca20c186bd829e
SHA1 8fce7bb92d4773fe6e9ab561bcced2b64461bbff
SHA512 9e85802598fbd76f48cf57da9d952dc0b4daf214d24ff1e1b9fc5ae7ca875fa883b1742193be33de7025a0a53e388c19336b4475e635579bd2ebbac76c27440e
SSDEEP 24576:C5eaRTFaujMmOFB+mJtmzBXkCacIINFYS:q/5M/JtmrrG
TLSH
T114B5C81BEBB610D5E0BAC13CD553222AFC7134A6833897DBA6C59E461B61BE4ED3D340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

969748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\estik\Desktop\macro\Project1\x64\Debug\Project1.pdb

kernel32

CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW Sleep CreateSemaphoreW GetCurrentProcess GetCurrentThread SetThreadPriority SetPriorityClass GetTickCount64 GetModuleHandleW SetThreadAffinityMask SetConsoleCtrlHandler SetConsoleTitleA CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetCurrentProcessId InitializeSListHead GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree HeapSize HeapValidate GetSystemInfo GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW RtlUnwind

user32

GetMessageW TranslateMessage DispatchMessageW PostQuitMessage SendInput MapVirtualKeyA GetForegroundWindow GetWindowTextA SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx

winmm

timeEndPeriod timeBeginPeriod

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpAddRequestHeaders

Name

.textbss

Size

Virtual Size

926KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

340KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

581B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1XygiGG (1).exe

kernel32

user32

winmm

winhttp

generic