prism[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

prism.exe
Size

21.9MB
MD5

69e7dbc0faf700ff62782aff23cc0b6b
SHA1

1ac42eec5fd4f06933e9332de3e8854319ec2f0f
SHA256

8e3cc983ac8fae4a6284d45142218e92f7381083a1413024ea80969578f62fe3
SHA512

3414d1e9c11c93765646adb37cd7d8ccee9080c15aa7ede02116e1504425b4d2ede7781a4b6ce82d6c9ab7ddf54b6c8802e93b294daaa482f648138f568db854
SSDEEP

98304:Y2V5nT7tbC+NhQ/+uX2LDxt6jhn1Mp31SwGr2bmuI/4J5bUHVOOyuR/3HvuvU:Y2VpT7tM+uXioMh1W1ru5bUH9

Score

1^/10

Malware Config

Signatures

Files

prism.exe
.exe windows x64

c89f8e3de16637404cdcd1bc0972a4e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
RtlVirtualUnwind
VirtualProtect
VirtualQuery
__C_specific_handler
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIo
CancelIoEx
CloseHandle
CompareStringOrdinal
ConnectNamedPipe
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
ExitProcess
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLogicalProcessorInformation
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeInfo
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryA
LoadLibraryExW
LoadLibraryW
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadErrorMode
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
UnmapViewOfFile
UnregisterWaitEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteFileEx

ucrtbase

__acrt_iob_func
__daylight
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__environ
__p__fmode
__p__wenviron
__setusermatherr
__stdio_common_vfprintf
__stdio_common_vfwprintf
__timezone
__tzname
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_fpreset
_hypot
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
_set_new_mode
_tzset
abort
acosf
atan2f
calloc
cbrtf
ceil
ceilf
cos
cosf
exit
exp2f
expf
floor
floorf
fmodf
free
fwrite
log
log10
log2f
malloc
memcmp
memcpy
memmove
memset
pow
powf
round
roundf
signal
sin
sinf
strerror
strlen
strncmp
trunc
truncf
wcslen

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError

advapi32

OpenProcessToken
SystemFunction036

bcrypt

BCryptGenRandom

dwmapi

DwmEnableBlurBehindWindow

gdi32

ChoosePixelFormat
CreateDIBitmap
CreateRectRgn
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceCaps
GetObjectW
SetPixelFormat
SwapBuffers

imm32

ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow

ole32

CoCreateGuid
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop

oleaut32

GetErrorInfo
SafeArrayCreateVector
SafeArrayPutElement
SetErrorInfo
SysAllocStringLen
SysFreeString
SysStringLen

opengl32

wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
wglShareLists

shell32

DragFinish
DragQueryFileW
SHCreateItemFromParsingName

shlwapi

AssocQueryStringW

uiautomationcore

UiaGetReservedNotSupportedValue
UiaHostProviderFromHwnd
UiaLookupId
UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaReturnRawElementProvider

user32

AdjustWindowRectEx
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CloseTouchInputHandle
CountClipboardFormats
CreateIcon
CreateWindowExW
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
EmptyClipboard
EnableMenuItem
EnumClipboardFormats
EnumDisplayMonitors
GetActiveWindow
GetClassInfoExW
GetClassNameW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardFormatNameW
GetCursorPos
GetDC
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageW
GetMonitorInfoW
GetPropW
GetRawInputData
GetRawInputDeviceInfoW
GetSystemMenu
GetSystemMetrics
GetTouchInputInfo
GetUpdateRect
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InvalidateRgn
IsClipboardFormatAvailable
IsIconic
IsProcessDPIAware
LoadCursorW
LoadImageW
MapVirtualKeyA
MapVirtualKeyW
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjectsEx
OpenClipboard
PeekMessageW
PostMessageW
PostThreadMessageW
RedrawWindow
RegisterClassExW
RegisterClipboardFormatW
RegisterRawInputDevices
RegisterTouchWindow
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendInput
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetForegroundWindow
SetPropW
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicodeEx
TrackMouseEvent
TranslateMessage
ValidateRect

userenv

GetUserProfileDirectoryW

uxtheme

SetWindowTheme

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps

ws2_32

WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAIoctl
WSAPoll
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 543KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 554KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 897KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/71
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/83
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/96
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/107
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/123
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/137
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/153
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/169
Size: 512B - Virtual size: 94B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c89f8e3de16637404cdcd1bc0972a4e6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ucrtbase

ntdll

advapi32

bcrypt

dwmapi

gdi32

imm32

ole32

oleaut32

opengl32

shell32

shlwapi

uiautomationcore

user32

userenv

uxtheme

winmm

ws2_32

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.data Size: 9KB - Virtual size: 9KB

.rdata Size: 2.7MB - Virtual size: 2.7MB

/4 Size: 512B - Virtual size: 4B

.pdata Size: 267KB - Virtual size: 266KB

.xdata Size: 543KB - Virtual size: 542KB

.bss Size: - Virtual size: 2KB

.idata Size: 16KB - Virtual size: 15KB

.CRT Size: 512B - Virtual size: 120B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 42KB - Virtual size: 41KB

/14 Size: 1024B - Virtual size: 672B

/29 Size: 554KB - Virtual size: 553KB

/45 Size: 897KB - Virtual size: 897KB

/57 Size: 5KB - Virtual size: 5KB

/71 Size: 371KB - Virtual size: 370KB

/83 Size: 1024B - Virtual size: 968B

/96 Size: 1.3MB - Virtual size: 1.3MB

/107 Size: 512B - Virtual size: 216B

/123 Size: 510KB - Virtual size: 510KB

/137 Size: 1024B - Virtual size: 681B

/153 Size: 1KB - Virtual size: 1KB

/169 Size: 512B - Virtual size: 94B

.text
Size: 7.2MB - Virtual size: 7.2MB

.data
Size: 9KB - Virtual size: 9KB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

/4
Size: 512B - Virtual size: 4B

.pdata
Size: 267KB - Virtual size: 266KB

.xdata
Size: 543KB - Virtual size: 542KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 16KB - Virtual size: 15KB

.CRT
Size: 512B - Virtual size: 120B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 42KB - Virtual size: 41KB

/14
Size: 1024B - Virtual size: 672B

/29
Size: 554KB - Virtual size: 553KB

/45
Size: 897KB - Virtual size: 897KB

/57
Size: 5KB - Virtual size: 5KB

/71
Size: 371KB - Virtual size: 370KB

/83
Size: 1024B - Virtual size: 968B

/96
Size: 1.3MB - Virtual size: 1.3MB

/107
Size: 512B - Virtual size: 216B

/123
Size: 510KB - Virtual size: 510KB

/137
Size: 1024B - Virtual size: 681B

/153
Size: 1KB - Virtual size: 1KB

/169
Size: 512B - Virtual size: 94B