illusion[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

illusion.exe
Size

1.2MB
MD5

d574d91650e3927e9e4c8ff96b854895
SHA1

6791683d8185f42e68d3fe6a24701c77c012dab8
SHA256

8093e4a899faa8283b1573f571834fffbee872c7e40da384bf36e6edb9b88a8e
SHA512

a894f1dc0bf8600f43494cd2c9c48ff808ba72197c1e4df6aa1e126fe2151dac029fdcfe39be29fc0cb3000e20986576fa5515398f5ceb642600a70ac69023f2
SSDEEP

24576:IFR6sTDhiSdVNgKGNVJWTaj96Gw/FzdrUyBLdSGbUNssvdkEt5Pu+:JkrdgKGNVJWTa+/VJUymvN5FkEH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
illusion.exe

Files

illusion.exe
.exe windows x86

45ca84b27db6256c0862c04c0b2fb26f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegOpenKeyExA
RegGetValueA
CryptSetKeyParam
CryptHashData
CryptEncrypt
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptAcquireContextA

kernel32

WideCharToMultiByte
VirtualQuery
VirtualProtect
TlsGetValue
Sleep
SetUnhandledExceptionFilter
MultiByteToWideChar
LoadLibraryA
LeaveCriticalSection
IsDebuggerPresent
IsDBCSLeadByteEx
InitializeCriticalSection
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFileSize
GetCurrentThread
GetCurrentProcess
FlushInstructionCache
ExitProcess
EnterCriticalSection
DeleteCriticalSection
CreateThread
CheckRemoteDebuggerPresent

msvcrt

wcslen
vfprintf
time
strncmp
strlen
strerror
strcpy
strchr
strcat
srand
signal
setlocale
memset
memcpy
malloc
localeconv
fwrite
free
fputc
fprintf
exit
calloc
atoi
abort
_unlock
_onexit
_lock
_iob
_initterm
_errno
_cexit
_amsg_exit
__setusermatherr
__set_app_type
__p__fmode
__p__commode
__p__acmdln
__mb_cur_max
__lconv_init
__initenv
__getmainargs

user32

GetSystemMetrics

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45ca84b27db6256c0862c04c0b2fb26f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.data Size: 512B - Virtual size: 84B

.rdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 60B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 512B - Virtual size: 84B

.rdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 60B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1KB - Virtual size: 1KB