atom[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

atom.exe
Size

1.1MB
MD5

2a9c620b825ce786d8e3d6c26a274607
SHA1

a5f771bc206a270e5d8091d0dc6162495b7fb553
SHA256

5cd217316c862fcdcf80208447ac06c6d36cd896d525a1a5b36999b44809d269
SHA512

92874f317dace48104244b72d9e6d0503625860b7bd1b4f57a724d682d7f4d59ec872846fde3ccce3af7d0af4f3b535e1dc20c7b289fb0a38577f7eec9bd3742
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atom.exe

Files

atom.exe
.exe windows x86

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetCurrentThreadId
SetEvent
DeleteFileW
CopyFileW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
GetTickCount
GetACP
SetLastError
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
WaitForSingleObject
GetStartupInfoW
CreateProcessW
LocalFree
InitializeCriticalSection
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
CreateEventA
DuplicateHandle
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
InterlockedDecrement
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
ReadFile
SetFilePointer
WriteFile
EncodePointer
SetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
DecodePointer
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
FlushFileBuffers
GetFileType
ReadConsoleW
GetConsoleMode
GetCurrentThread
FreeLibraryAndExitThread
CreateThread
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetModuleHandleA
GetLogicalProcessorInformation
OpenEventA
GetUserDefaultLCID
Sleep
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
CreateEventW
GetExitCodeProcess
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetStringTypeW
TryEnterCriticalSection
InitializeSListHead
GetCurrentProcessId
FormatMessageA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
LCMapStringW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
SwitchToThread

user32

RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyWindow
GetWindowLongW
SetTimer
KillTimer
UnregisterClassW
GetCursorPos
SendMessageW
PostThreadMessageW
wsprintfW
DefWindowProcW
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindowTextLengthW
GetWindow
GetFocus
GetDC
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
GetSystemMetrics
SetWindowTextW
ShowWindow
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
GetClassNameW
SetCapture
GetClientRect
GetDlgItem
PostQuitMessage
SystemParametersInfoW
GetParent
RegisterWindowMessageW
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

OleUninitialize
CoCreateInstance
CoAddRefServerProcess
CoTaskMemFree
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoReleaseServerProcess
OleInitialize
StringFromCLSID

oleaut32

DispCallFunc
VariantChangeType
LoadRegTypeLi
VariantInit
LoadTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocString
VariantCopy
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
SysAllocStringByteLen

advapi32

CryptDestroyKey
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
CryptAcquireContextW

shlwapi

PathFindFileNameW

ws2_32

ntohl

Sections

.text
Size: 408KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1f2e4d7152de49a56bae29cef62f97

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

ws2_32

Sections

.text Size: 408KB - Virtual size: 408KB

.rdata Size: 140KB - Virtual size: 140KB

.data Size: 29KB - Virtual size: 34KB

.rsrc Size: 544KB - Virtual size: 543KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 408KB - Virtual size: 408KB

.rdata
Size: 140KB - Virtual size: 140KB

.data
Size: 29KB - Virtual size: 34KB

.rsrc
Size: 544KB - Virtual size: 543KB

.reloc
Size: 31KB - Virtual size: 30KB