Plutonia[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Plutonia.exe
Size

657KB
MD5

b8f63e4b5f743daf7e0141a3989120a2
SHA1

db976c5d1cc03dc8015aed4310514d858fc35868
SHA256

8c34635dff5a319ed2fb9ba78ced1375ad71d58628b1517d96118b7e3c9894bd
SHA512

9cb45832ea589757bc58fa028c33c40fff573dc0e08bb71d5be205a22274cb5080c387525aa70fa65162de52809a9c95a873f5c4366179673ea0f934c0bbd2cb
SSDEEP

12288:mrLJR1nVUHOVOA19Z9lCBXHcOnHx1oKaQMBL36p0HZ2:mrlR5VV919nuH3baQMBoc2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Plutonia.exe

Files

Plutonia.exe
.exe windows:4 windows x64 arch:x64

9d936ad839699a281549fee0d2c9d446

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameA
UnmapViewOfFile
ReleaseMutex
CreateMutexA
MapViewOfFile
CreateFileMappingA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileSize
CreateFileA
GetCurrentDirectoryA
ReadFile
CreateEventA
SetThreadPriority
GetCurrentThread
SetEvent
Sleep
GetVersionExA
WriteFile
SetStdHandle
SetFilePointer
CreateProcessA
DuplicateHandle
CreatePipe
GetStdHandle
GetExitCodeProcess
OpenProcess
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
PulseEvent
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
RtlUnwindEx
MultiByteToWideChar
WideCharToMultiByte
SetConsoleCtrlHandler
ExitThread
CreateThread
SetCurrentDirectoryA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
ResumeThread
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapSetInformation
HeapCreate
LCMapStringA
LCMapStringW
RaiseException
HeapSize
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlPcToFileHeader
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTimeZoneInformation
GetLocaleInfoW
GetFileAttributesA
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
WaitForSingleObject
GetExitCodeThread
CloseHandle
lstrlenA
GetFullPathNameA
SetErrorMode
LoadLibraryA
GetProcAddress
GetLastError
FormatMessageA
LocalFree
ExitProcess
FreeLibrary
SetEnvironmentVariableW

user32

TranslateMessage
DispatchMessageA
KillTimer
SetTimer
GetClassInfoA
LoadCursorA
RegisterClassA
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
DefWindowProcA
GetClientRect
BeginPaint
EndPaint
PostQuitMessage
PostMessageA
LoadBitmapA
MessageBoxA
GetMessageA

gdi32

DeleteObject
GetObjectA
CreateCompatibleDC
SelectObject
DeleteDC
BitBlt

advapi32

RegOpenKeyExA
RegSetValueExA
OpenProcessToken
GetTokenInformation
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

comctl32

InitCommonControlsEx

Exports

Exports

Java_com_regexlab_j2e_InstancesReplyImpl_set
Java_com_regexlab_j2e_Instances_flush
Java_com_regexlab_j2e_Instances_getCurrentInstance
Java_com_regexlab_j2e_Instances_getFirstInstance
Java_com_regexlab_j2e_Instances_getInstances
Java_com_regexlab_j2e_Instances_getReply
Java_com_regexlab_j2e_Instances_sendObject
Java_com_regexlab_j2e_Instances_setReceiver
Java_com_regexlab_j2e_RedirOutputStream_write
Java_com_regexlab_j2e_SplashScreen_nativeAutoClose
Java_com_regexlab_j2e_SplashScreen_nativeClose
Java_com_regexlab_j2e_SplashScreen_nativeGetSplashScreen

Sections

.text
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHMMESS
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d936ad839699a281549fee0d2c9d446

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

Exports

Exports

Sections

.text Size: 210KB - Virtual size: 209KB

.rdata Size: 59KB - Virtual size: 58KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 17KB - Virtual size: 16KB

.SHMMESS Size: 3KB - Virtual size: 3KB

.rsrc Size: 34KB - Virtual size: 34KB

.text
Size: 210KB - Virtual size: 209KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 17KB - Virtual size: 16KB

.SHMMESS
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 34KB - Virtual size: 34KB