Entropy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Entropy.exe
Size

4.8MB
MD5

0fc0200cc5a0d79c282337c55f489fc4
SHA1

48ab3d9ad21964172855e68ab7f6e4825529b570
SHA256

34cf0cb43e8fa6dbe7cde98b2923b6195a5971875d140665197fa92309f840eb
SHA512

b885f11a9ae3cf720a9f57235f2704e9f5ade6ff048bea4a36a4e42989fee3ba569901fca40c95d96d62d0fe97fb1a12f1ad10e6a0a6c566264d9ac92fcbc92b
SSDEEP

49152:Q/BwBsODlYO+OGXCBDy1kGmOlczBhP1PwkZu6m7SHv6IrXYZGDqIgRQBqWgSIfIe:WgUvXkL+QBqW8f7hjMSdverg5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Entropy.exe

Files

Entropy.exe
.exe windows:6 windows x64 arch:x64

92d9f5028df4b7c055ebca7b619ece8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ws2_32

WSAIoctl
setsockopt
ioctlsocket
WSASocketW
getsockname
getpeername
connect
closesocket
WSAGetLastError
shutdown
getsockopt
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
recv
send
WSASend
bind

kernel32

WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindFirstFileW
WaitForSingleObject
GetConsoleMode
GetStdHandle
GetCurrentThread
SwitchToThread
ExitProcess
QueryPerformanceCounter
GetCurrentDirectoryW
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
WakeConditionVariable
SleepConditionVariableSRW
CreateThread
GetModuleHandleA
SetHandleInformation
HeapReAlloc
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
PostQueuedCompletionStatus
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WakeAllConditionVariable
CloseHandle
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeConsole
MultiByteToWideChar
SetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FindClose
FindNextFileW
GetProcAddress
GetFinalPathNameByHandleW
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LoadLibraryA
TryAcquireSRWLockExclusive
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetTempPathW
GetQueuedCompletionStatusEx
GetLastError
GetDiskFreeSpaceA

crypt32

CryptUnprotectData
CertOpenStore
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertGetCertificateChain
CertDuplicateCertificateChain

secur32

FreeCredentialsHandle
EncryptMessage
ApplyControlToken
DecryptMessage
QueryContextAttributesW
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
AcquireCredentialsHandleA
DeleteSecurityContext

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
RegQueryValueExW
SystemFunction036
RegOpenKeyExW

iphlpapi

GetAdaptersAddresses

vcruntime140

__CxxFrameHandler3
__C_specific_handler
memcpy
memcmp
memset
strrchr
memmove
__current_exception_context
__current_exception

api-ms-win-crt-string-l1-1-0

strlen
strcspn
strncmp
strspn
strcmp

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr
log

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_msize
realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate
_crt_atexit
_register_onexit_function
_endthreadex
_initialize_onexit_table
_beginthreadex
__p___argc
_exit
__p___argv
_cexit
exit
_initialize_narrow_environment
_initterm_e
_c_exit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1017KB - Virtual size: 1017KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92d9f5028df4b7c055ebca7b619ece8d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

ws2_32

kernel32

crypt32

secur32

bcrypt

advapi32

iphlpapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 1017KB - Virtual size: 1017KB

.data Size: 22KB - Virtual size: 24KB

.pdata Size: 89KB - Virtual size: 89KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 1017KB - Virtual size: 1017KB

.data
Size: 22KB - Virtual size: 24KB

.pdata
Size: 89KB - Virtual size: 89KB

.reloc
Size: 28KB - Virtual size: 27KB