Enigma paste[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Enigma paste.exe
Size 3.2MB
Sample240525-dytwdach96
SHA256 c64f1f0f53f7d84234f9e3b701227ab42acbf970903a3087dbccfbe9a70feba4
MD5 dca04ff45d860793cbe7058840681e37
SHA1 9b9539fbd10445e089514608c66fa123723d45d3
SHA512 6b9fade21067e0c709969fdfa03b71ff16b88b2a986234d15c21ae979370b4f7cfc968e4743b91bdc9ba71ad847d331100a547a50a0dbf8f5d0cbc866a83089d
SSDEEP 49152:A9QgIiQf55SGogn9cTdse8o3zN+RLn36PSAwdxgn1GDaeRbTj2bAuSfSPyIA:A9fT9Tdn8ojURji/8+2bj20pfuy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Enigma paste.exe

File Explorer

Enigma paste.exe

.exe 3.2MB

Enigma paste.exe

IMPHASH 3b73e5c373c6e226e0eaf59c2ee9f427
SHA256 c64f1f0f53f7d84234f9e3b701227ab42acbf970903a3087dbccfbe9a70feba4
MD5 dca04ff45d860793cbe7058840681e37
SHA1 9b9539fbd10445e089514608c66fa123723d45d3
SHA512 6b9fade21067e0c709969fdfa03b71ff16b88b2a986234d15c21ae979370b4f7cfc968e4743b91bdc9ba71ad847d331100a547a50a0dbf8f5d0cbc866a83089d
SSDEEP 49152:A9QgIiQf55SGogn9cTdse8o3zN+RLn36PSAwdxgn1GDaeRbTj2bAuSfSPyIA:A9fT9Tdn8ojURji/8+2bj20pfuy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

813692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\donot\Desktop\Enigma Selfleak\p2c\build\Enigma paste.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleW QueryFullProcessImageNameW SetLastError FormatMessageA LocalFree EnterCriticalSection LeaveCriticalSection SleepEx VerSetConditionMask GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetFileSizeEx CreateFileMappingW VirtualProtect GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetPrivateProfileStringA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI QueryPerformanceCounter GetPrivateProfileIntA GetConsoleWindow FreeLibrary GetCurrentProcessId GetProcAddress CreateThread WritePrivateProfileStringA Process32FirstW QueryPerformanceFrequency LoadLibraryA CreateFileA Process32NextW Sleep OpenProcess GetModuleHandleA FindClose TerminateProcess VirtualAlloc CloseHandle CreateToolhelp32Snapshot GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetLastError OutputDebugStringW GetFileAttributesExW FindFirstFileW CreateDirectoryW GetCurrentDirectoryW MapViewOfFile WriteFile CreateFileW ReleaseSRWLockExclusive GetLocaleInfoEx FlushFileBuffers

user32

GetClipboardData FindWindowA SetClipboardData UpdateWindow SetCursorPos SendInput GetCursorPos OpenClipboard CloseClipboard SetFocus SetWindowLongPtrA GetWindowThreadProcessId GetKeyState DispatchMessageA GetWindowRect LoadCursorA DestroyWindow SetWindowPos ScreenToClient GetSystemMetrics GetClassNameA ShowWindow GetAsyncKeyState SetWindowLongA ClientToScreen GetWindowTextA GetWindowLongA SetWindowDisplayAffinity MessageBoxA GetForegroundWindow SetMenu EnumWindows GetDesktopWindow TranslateMessage mouse_event SetCursor GetClientRect PeekMessageA GetWindowLongPtrA EmptyClipboard

advapi32

CryptHashData AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid SetSecurityInfo CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenProcessToken

shell32

ShellExecuteW ShellExecuteA

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Mtx_unlock ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?setf@ios_base@std@@QEAAHHH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind ZwClose ZwQueryValueKey ZwCreateKey RtlLookupFunctionEntry ZwSetValueKey RtlCaptureContext ZwOpenKey

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

normaliz

IdnToAscii

wldap32

ord301 ord200 ord143 ord45 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord217 ord60 ord211 ord46

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertOpenStore PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

ws2_32

ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl connect WSASetLastError socket setsockopt closesocket ntohs htons recv getsockopt getsockname send WSAGetLastError getpeername bind

shlwapi

PathFindFileNameW

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __C_specific_handler __current_exception_context __std_exception_copy __std_terminate strstr _CxxThrowException memchr memcmp memcpy memmove memset strchr strrchr __current_exception

api-ms-win-crt-stdio-l1-1-0

_read feof _close _open __stdio_common_vsscanf ftell __stdio_common_vsprintf fputs _write fopen fclose __p__commode _wfopen fwrite __acrt_iob_func _set_fmode fflush fputc _lseeki64 __stdio_common_vsprintf_s _popen _pclose fgets _get_stream_buffer_pointers _fseeki64 fsetpos fgetc ungetc setvbuf fgetpos __stdio_common_vfprintf fseek fread

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strspn wcscpy_s isupper _wcsicmp strcmp strncpy strncmp strpbrk tolower _strdup strcspn

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free calloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate _errno _getpid abort _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type strerror _get_initial_narrow_environment _initterm _initterm_e _exit __sys_nerr __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback exit _invalid_parameter_noinfo_noreturn system

api-ms-win-crt-convert-l1-1-0

atoi atof strtoul strtol strtoll strtod strtoull

api-ms-win-crt-math-l1-1-0

powf sqrtf fmodf cosf ceilf atan2 asin acosf __setusermatherr tanf sinf

api-ms-win-crt-filesystem-l1-1-0

_stat64 _access _unlink _unlock_file _lock_file _fstat64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64 _gmtime64