arctic-patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
arctic-patched.exe
Size 1.8MB
Sample240324-eql18scb8y
SHA256 936600ab3b15c5d7f922c1aa4189c7978b2eabf98f185176b02a7430c58f042b
MD5 5040ee0a68e6c0546fde756e68e9b2bf
SHA1 3e2d9c7c3901cfae24c90f50899d74ea1858131f
SHA512 e85d289efa140ecb27cbb6eafbebdf79dba27f8c79808362aca12da3b53a12d4361f1bf826bf7ccdf0f11bad076c81bd8a150ec69276f9335136fdffe6879fce
SSDEEP 49152:LhKvJSHjwoMg18Yc5GYbMCAnv9Vm9pTPXx:Lh/Dwxg1U5C
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
arctic-patched.exe

File Explorer

arctic-patched.exe

.exe 1.8MB

arctic-patched.exe

IMPHASH 1ca7901746af6065a111f37b6400d60c
SHA256 936600ab3b15c5d7f922c1aa4189c7978b2eabf98f185176b02a7430c58f042b
MD5 5040ee0a68e6c0546fde756e68e9b2bf
SHA1 3e2d9c7c3901cfae24c90f50899d74ea1858131f
SHA512 e85d289efa140ecb27cbb6eafbebdf79dba27f8c79808362aca12da3b53a12d4361f1bf826bf7ccdf0f11bad076c81bd8a150ec69276f9335136fdffe6879fce
SSDEEP 49152:LhKvJSHjwoMg18Yc5GYbMCAnv9Vm9pTPXx:Lh/Dwxg1U5C
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1259572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\andre\OneDrive\Documents\src\arctic\Release\arctic.pdb

kernel32

WaitForMultipleObjects GetFileSizeEx OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx ReadFile AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection EnterCriticalSection LocalFree QueryFullProcessImageNameW GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy FreeConsole QueryPerformanceCounter VerSetConditionMask QueryPerformanceFrequency GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar lstrcmpiA Process32Next CreateFileA CreateToolhelp32Snapshot CreateFileW Process32First GetCurrentProcess SetLastError CloseHandle LoadLibraryA GetCurrentProcessId GetModuleHandleA VirtualAlloc DeviceIoControl VirtualFree Sleep GetModuleFileNameA SetConsoleTitleA FormatMessageA FreeLibrary PeekNamedPipe GetProcAddress GetLastError LoadLibraryExA

user32

DispatchMessageA ShowWindow GetSystemMetrics DestroyWindow UnregisterClassA PostQuitMessage RegisterClassExA SetWindowLongA UpdateWindow GetKeyState LoadCursorA LoadIconA MonitorFromWindow GetCapture ClientToScreen TrackMouseEvent SetCapture TranslateMessage SetCursor GetClientRect SetProcessDPIAware ReleaseCapture SetCursorPos OpenClipboard CloseClipboard SetWindowDisplayAffinity GetMonitorInfoA MoveWindow DefWindowProcA SetLayeredWindowAttributes GetWindowRect FindWindowA SendInput GetCursorPos GetForegroundWindow GetAsyncKeyState ScreenToClient CreateWindowExA MessageBoxA SetClipboardData GetClipboardData EmptyClipboard PeekMessageA

gdi32

CreateSolidBrush

advapi32

CryptCreateHash AddAccessAllowedAce GetLengthSid GetTokenInformation RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken RegSetValueExA RegDeleteKeyA RegOpenKeyA AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyA InitializeAcl IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptHashData CryptDestroyHash CryptDestroyKey CryptEncrypt CryptImportKey

shell32

ShellExecuteA SHGetFolderPathW

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Xtime_get_ticks ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Syserror_map@std@@YAPEBDH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

ntdll

RtlAnsiStringToUnicodeString NtQuerySystemInformation RtlVirtualUnwind RtlInitUnicodeString RtlCaptureContext RtlInitAnsiString RtlLookupFunctionEntry

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove memcpy memcmp memchr _CxxThrowException __current_exception strrchr longjmp strchr strstr __std_terminate _purecall __std_exception_copy __std_exception_destroy __current_exception_context __C_specific_handler __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

calloc realloc _set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

ceilf ceil atan2f cos cosf atan2 exp __setusermatherr _dsign floorf fmod frexp tan sqrtf asin acosf acos sqrt _dclass sinf sin powf pow llround log10 log ldexp fmodf floor

api-ms-win-crt-string-l1-1-0

strpbrk isgraph isupper tolower isspace iscntrl ispunct islower strcoll isalpha _stricmp strncpy strcmp strcspn isdigit strspn _strdup isalnum toupper isxdigit isblank strncmp

api-ms-win-crt-runtime-l1-1-0

strerror _beginthreadex _invalid_parameter_noinfo_noreturn _errno system terminate perror __sys_nerr _invalid_parameter_noinfo _resetstkoflw exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc abort _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _getpid

api-ms-win-crt-stdio-l1-1-0

_lseeki64 _set_fmode __p__commode freopen fwrite _read _write __stdio_common_vsscanf _wfopen clearerr ferror fseek ftell _close fopen _pclose _open fgets _get_stream_buffer_pointers fsetpos fgetpos fgetc fputc tmpfile setvbuf _popen ungetc _ftelli64 _fseeki64 fread __acrt_iob_func tmpnam __stdio_common_vsprintf fflush fclose getc __stdio_common_vfprintf fputs feof

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-time-l1-1-0

clock _mktime64 strftime _gmtime64 _localtime64 _difftime64 _time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

strtol atoi atof strtoull strtoll strtod strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _stat64 _unlink _access rename _lock_file _fstat64 remove

api-ms-win-crt-utility-l1-1-0

rand qsort

ws2_32

socket setsockopt ntohs htons WSAIoctl sendto getsockopt WSAStartup WSACleanup recvfrom getsockname gethostname getpeername closesocket recv send WSAGetLastError ntohl bind WSASetLastError connect accept htonl listen ioctlsocket freeaddrinfo getaddrinfo select __WSAFDIsSet

normaliz

IdnToAscii

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertFreeCertificateChain CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertGetCertificateChain CertGetNameStringA

wldap32

ord60 ord45 ord50 ord211 ord22 ord26 ord27 ord46 ord41 ord143 ord32 ord33 ord35 ord79 ord30 ord301 ord217 ord200