Infinity[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Infinity.rar
Size 2.7MB
Sample240607-a6vabsff88
SHA256 8e361a41a92afff99fdc21bfcd16c278a7682c82112a4cb8b4cef8c9a4f20a67
MD5 fa3ad0d1595d4906c2cd8210990d9b05
SHA1 35112747e1d3ce6451c9a23c63dd239df666e9ac
SHA512 433fd6dbb0a14f14e74223db191762f2d9f2e71fbf01e2344e897d4d0c7c4083d8fa562938fd5d45d3c526d78bfa9bfa9ff6deb438720db9e1b9934ab8be453e
SSDEEP 49152:fEvRHljuJRxaX96xmSn3JrUCT0gmknbp+4FslGukXINhoaenZMse:8vBljuJRIXWmS3JYKNnV+4FslxkXINSi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Infinity/infinity-external.exe

File Explorer

Infinity.rar

.rar 2.7MB
Infinity/imgui.ini

241B
Infinity/infinity-external.exe

.exe 3.5MB

Infinity.rar

SHA256 8e361a41a92afff99fdc21bfcd16c278a7682c82112a4cb8b4cef8c9a4f20a67
MD5 fa3ad0d1595d4906c2cd8210990d9b05
SHA1 35112747e1d3ce6451c9a23c63dd239df666e9ac
SHA512 433fd6dbb0a14f14e74223db191762f2d9f2e71fbf01e2344e897d4d0c7c4083d8fa562938fd5d45d3c526d78bfa9bfa9ff6deb438720db9e1b9934ab8be453e
SSDEEP 49152:fEvRHljuJRxaX96xmSn3JrUCT0gmknbp+4FslGukXINhoaenZMse:8vBljuJRIXWmS3JYKNnV+4FslxkXINSi
MD5 SHA1 SHA512 SSDEEP

Password

Infinity/infinity-external.exe

IMPHASH b4a362e1979f738695a8fbaf9df1f936
SHA256 935344ba53d32bed60dd33a49057f21b00452ac7aacc75b2146b59a42b5c1129
MD5 b2d9f25376f9699fc052e2b3a5abf94f
SHA1 361d6c3f29f0748053c2817edb256d2d2e128bd5
SHA512 eba5e457d26f6aef121d01950e972d5acc77d2aba47a10f07afe162b8948ecef68076a3f31a5aaf75018712be257cc4b8180c8d98cc9d36bae6be27171eb5034
SSDEEP 49152:hmzYokyfG7rnHQiyI6OWiB13BBSDGgvPJ+msrEPUbCramnHzTDRdIaiIRu0:YYo1fliM0j3PSDJvPErEMbCramTTM30
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

476796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Dovyl\Desktop\InfinityV2\External\x64\Release\infinity-external.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter Process32First CreateToolhelp32Snapshot Process32Next lstrcmpiA GlobalFree UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GlobalAlloc GetLastError AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead GlobalLock MultiByteToWideChar GetTempPathW GetCurrentProcessId GetProcAddress CloseHandle GetModuleHandleA GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl VirtualFree Sleep SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcess

user32

CreateWindowExA TranslateMessage LoadIconA PeekMessageA SetLayeredWindowAttributes SetWindowLongA PostQuitMessage DefWindowProcW DispatchMessageA DestroyWindow RegisterClassExA UpdateWindow GetKeyState GetMessageExtraInfo LoadCursorA GetCapture ClientToScreen TrackMouseEvent ShowWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard UnregisterClassW CloseClipboard EmptyClipboard GetClipboardData SendInput GetCursorPos FindWindowA SetClipboardData GetForegroundWindow ScreenToClient GetAsyncKeyState GetSystemMetrics

gdi32

CreateSolidBrush

advapi32

RegSetKeyValueW RegCreateKeyW RegOpenKeyW RegCloseKey RegDeleteTreeW

shell32

SHGetFolderPathW

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

RtlCaptureContext RtlInitUnicodeString NtQuerySystemInformation RtlLookupFunctionEntry RtlVirtualUnwind

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memchr __std_exception_destroy memmove strstr __std_exception_copy __std_terminate memset _CxxThrowException __current_exception_context __current_exception __C_specific_handler wcsstr memcmp

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _set_app_type terminate _seh_filter_exe _invalid_parameter_noinfo_noreturn exit _cexit _crt_atexit _register_onexit_function _initterm _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _errno

api-ms-win-crt-stdio-l1-1-0

_fseeki64 _set_fmode __p__commode fputc __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fflush __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers fwrite fread fsetpos ungetc fclose setvbuf fgetpos fgetc

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-filesystem-l1-1-0

_wremove _unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

strncpy strcpy_s strncmp toupper strncpy_s _stricmp strcmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtoll strtod atof strtoull

api-ms-win-crt-math-l1-1-0

_dsign cosf sqrtf powf _dclass sinf ceilf fmodf __setusermatherr acosf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale