silhum[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

silhum.exe
Size

91KB
MD5

1216cf6407ae7f66483eddc00f1de627
SHA1

1ab5fdecd7cd3750aca59818e598256dd5f48899
SHA256

2a367885ca9f9316ee5365e6784954fe08868b645ccfbc5df1e156d25b31e060
SHA512

cc0298b118807098011384bc981a700af2a36ec6678513570bd1ddf6c84b01582db80b049df97a80a7c505275735eaf667338dafc54e3911ae19a621e003d3fe
SSDEEP

1536:NuCvpYqScwTK0LwtiznMC7sRb8UnZJJb6IAsw3h:ICxZScKKUwt2nR6b8v3h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
silhum.exe

Files

silhum.exe
.exe windows x64

1341c61e0e8f7fc528fe01a4934dfd55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExpandEnvironmentStringsW
CreateFileW
ResumeThread
OpenProcess
GetTickCount64
GetCurrentThread
WaitForSingleObjectEx
QueryPerformanceFrequency
CloseHandle
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
SleepEx
QueryPerformanceCounter
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
GetCurrentProcess
SetPriorityClass
HeapFree
GetFileInformationByHandleEx
ReadFile
WriteConsoleW
LoadResource
FindResourceExW
LockResource
GetStdHandle
GetCommandLineW
SetLastError
SizeofResource
GetModuleHandleW
GetLastError
MultiByteToWideChar
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
GetAce
CloseServiceHandle
OpenSCManagerW
SetTokenInformation
AllocateAndInitializeSid
IsWellKnownSid
AddAce
OpenProcessToken
CreateRestrictedToken
FreeSid
SetThreadToken
StartServiceW
InitializeAcl
CreateProcessAsUserW
OpenServiceW
GetLengthSid
DuplicateTokenEx
AddAccessAllowedAce
OpenThreadToken
QueryServiceStatusEx
GetTokenInformation

ole32

CoInitializeEx

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW
WTSQueryUserToken

msvcrt

malloc
??0exception@@QEAA@AEBQEBD@Z
_CxxThrowException
__C_specific_handler
_cexit
__setusermatherr
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
__argc
__argv
_environ
_errno
_amsg_exit
__getmainargs
atexit
memset
__DestructExceptionObject
memcpy
_lock
_unlock
__dllonexit
__set_app_type
abort
free
_commode
memmove
??3@YAXPEAX@Z
?terminate@@YAXXZ
_XcptFilter
wcsrchr
strncmp
_wcsicmp
wcsstr
_wcsnicmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
??2@YAPEAX_K@Z
memcmp

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1341c61e0e8f7fc528fe01a4934dfd55

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

userenv

wtsapi32

msvcrt

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 512B - Virtual size: 152B

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 512B - Virtual size: 152B