Skilla[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Skilla.exe
Size

226KB
MD5

4ca5abca0415544482494afd15339169
SHA1

db07b2f8c28f569e2677b555931190e0ce7a3e51
SHA256

e60a832b335ff95f37ddf1db1d8c958df003223e18660548e28c090f712a6dd1
SHA512

c7d15a2095ed4347e87f0988a64545e1d84c4d11c68448beef9b862f207358eda29065e5b18ca2b0d620476e8b0c327a0dbba932d2b54e740a320f10bca803c7
SSDEEP

6144:bHKcOzu+8gks7GyqInc/t/HR3qcXQs77f7f7Tf7/fIvXHm7fdvag:bqcOzu+8gks7Gyqr/tPZQs77f7f7Tf75

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Skilla.exe

Files

Skilla.exe
.exe windows x64

fa8b4ed33e8a7afbff15b25e9c5a387d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LoadLibraryExW
MultiByteToWideChar
RtlCompareMemory
QueryDosDeviceW
SetLastError
GetCurrentProcess
WriteFile
GetModuleFileNameW
CreateFileW
GetLogicalDriveStringsW
CreateEventW
Sleep
SwitchToThread
TlsSetValue
TlsGetValue
EncodePointer
WriteConsoleW
RaiseException
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetProcAddress
LCMapStringW
InitializeCriticalSectionAndSpinCount
FlsSetValue
FlsGetValue
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateThread
CloseHandle
ExitThread
ReleaseMutex
WaitForSingleObject
GetSystemTimeAsFileTime
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
FileTimeToLocalFileTime
HeapSetInformation
GetLastError
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateMutexW

user32

UnregisterClassW
EndDialog
SendMessageW
MessageBoxW
SetWindowPos
GetMenu
DefWindowProcW
CreateDialogParamW
GetMessageW
EnableMenuItem
SetWindowTextW
ReleaseCapture
SetCursor
SetCapture
LoadCursorW
DestroyIcon
RegisterClassExW
GetSubMenu
ShowWindow
DrawIconEx
CheckDlgButton
PostQuitMessage
DialogBoxParamW
UpdateWindow
LoadImageW
DispatchMessageW
IsDialogMessageW
SetMenuItemInfoW
IsDlgButtonChecked
SetFocus
TranslateMessage
InsertMenuW
ShowCursor
GetDlgItem
GetClientRect

comdlg32

GetSaveFileNameW

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
SHGetStockIconInfo

ole32

CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity

oleaut32

VariantClear
SysAllocString
VariantChangeType
VariantInit
SysFreeString

comctl32

ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx

shlwapi

ord176

uxtheme

SetWindowTheme

ntdll

NtSetInformationThread
RtlAllocateAndInitializeSid
NtQueryInformationToken
NtAllocateVirtualMemory
RtlInitUnicodeStringEx
NtOpenDirectoryObject
RtlFreeSid
NtQueryDirectoryObject
NtQueryLicenseValue
NtSetContextThread
RtlInitString
NtPrivilegeCheck
NtQueryInformationThread
RtlEqualSid
RtlUpcaseUnicodeChar
NtContinue
NtQueryObject
NtCreateFile
NtOpenSection
DbgPrint
NtQuerySecurityObject
NtMapViewOfSection
NtResumeThread
NtTerminateThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlSubAuthoritySid
NtCreateThreadEx
NtSuspendThread
RtlInitializeSid
NtGetContextThread
NtFreeVirtualMemory
RtlAnsiStringToUnicodeString
LdrGetDllHandle
RtlPushFrame
RtlRemoveVectoredExceptionHandler
RtlPopFrame
RtlGetFrame
RtlAddVectoredExceptionHandler
RtlCreateHeap
RtlDestroyHeap
NtCreateDebugObject
NtDuplicateObject
NtCompareObjects
RtlImageNtHeaderEx
LdrGetKnownDllSectionHandle
LdrEnumerateLoadedModules
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
RtlHashUnicodeString
RtlEqualUnicodeString
NtOpenFile
LdrUnlockLoaderLock
NtQueryPerformanceCounter
NtSetInformationProcess
LdrLockLoaderLock
RtlInitUnicodeString
NtCreateSection
NtSystemDebugControl
NtOpenProcessToken
RtlSetLastWin32Error
NtUnmapViewOfSection
RtlFreeHeap
NtClose
NtAreMappedFilesTheSame
NtOpenProcess
NtQueryInformationProcess
NtQuerySystemInformation
NtQueryVirtualMemory
RtlAllocateHeap
NtOpenThread
RtlGetNtVersionNumbers
RtlNtdllName
RtlSetUnhandledExceptionFilter
RtlNtStatusToDosError
RtlTimeToTimeFields
LdrFindEntryForAddress

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa8b4ed33e8a7afbff15b25e9c5a387d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

uxtheme

ntdll

Sections

.text Size: 111KB - Virtual size: 110KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 4KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 111KB - Virtual size: 110KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 4KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 2KB - Virtual size: 1KB