scrying[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

scrying.exe
Size

5.9MB
MD5

7c42df21e22b9c6cc87b2eebf219c01d
SHA1

0d24544c73a42a0ee9b6e6924e0019aa4b254db8
SHA256

e1eeb3735ada6088c8b1a740671d4430b26249f1f9b09b5052a00d398c832815
SHA512

4ffdd0ae3abb8c1a56e6365a9bfa91fd9d744e25deb5a8eedb538d83cd8493c4f36d1c0268552fe981ee851626a5b4abc294fe504d4e2eeaf1795165b2076ccf
SSDEEP

98304:2+fRnUFgeMpKsgyT3ek3OCBcno3RtC26VHr/K:kyi269

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
scrying.exe

Files

scrying.exe
.exe windows:6 windows x64

458e938207c0dee4bedfd2bd597b6450

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

listen
WSADuplicateSocketW
bind
connect
WSAStartup
WSASend
getaddrinfo
shutdown
recv
send
WSASocketW
WSACleanup
closesocket
freeaddrinfo
WSAGetLastError

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SystemFunction036

crypt32

CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

kernel32

DeviceIoControl
CreateDirectoryW
FindFirstFileW
SetHandleInformation
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateProcessW
CreateNamedPipeW
CreateThread
WriteConsoleW
ReadConsoleW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetProcessId
CreateSemaphoreA
SetConsoleCtrlHandler
CloseHandle
WaitForSingleObject
ReleaseSemaphore
QueryPerformanceCounter
GetStdHandle
GetConsoleMode
GetFileInformationByHandleEx
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SetFileAttributesW
SetFileInformationByHandle
SetLastError
GetFinalPathNameByHandleW
GetLastError
GetSystemTimeAsFileTime
QueryPerformanceFrequency
ReleaseMutex
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
InitializeCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
FindClose
FreeEnvironmentStringsW
DeleteCriticalSection
SwitchToThread
Sleep
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetTempPathW
GetCommandLineW
WriteFile
DuplicateHandle
ReadFile
SetFilePointerEx
EnterCriticalSection
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetProcessHeap
HeapAlloc
HeapFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
AddVectoredExceptionHandler
GetModuleHandleW
FindNextFileW
CreateFileW
GetFileInformationByHandle

secur32

FreeCredentialsHandle
AcquireCredentialsHandleA
QueryContextAttributesW
DeleteSecurityContext
DecryptMessage
AcceptSecurityContext
InitializeSecurityContextW
EncryptMessage
FreeContextBuffer

vcruntime140

__C_specific_handler
_CxxThrowException
memset
__current_exception
memcpy
memcmp
__CxxFrameHandler3
memmove
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_wassert
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_get_initial_narrow_environment
_exit
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

roundf
round
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

458e938207c0dee4bedfd2bd597b6450

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

crypt32

kernel32

secur32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 172KB - Virtual size: 171KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 172KB - Virtual size: 171KB

.reloc
Size: 42KB - Virtual size: 41KB