PisiValo[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PisiValo.exe
Size 1.2MB
Sample240608-rnqymadc67
SHA256 62ea8ac2927d5de142414964ba812d8fbd18b890569f39d2ed9ef79a538eac49
MD5 8d3d5a1d29ddfb4fdbef90f09f9f54de
SHA1 a22da1d825e52f59f045c776a9d20393f74d8df0
SHA512 ea9d6d285d51fdc3848a8fa8834bb0775d297bf416985c507e5eaaf7fc290863defc1e126f361d35acee9b196e5da64e10b80cc12987738ffa12c2d3e3036757
SSDEEP 24576:WkQhavMUptl7Ko60OegX7AonnJXnMvQo:WkSodM0Ervnn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PisiValo.exe

File Explorer

PisiValo.exe

.exe 1.2MB

PisiValo.exe

IMPHASH bace0bd2e9744a69e6fe6d64c3bef23d
SHA256 62ea8ac2927d5de142414964ba812d8fbd18b890569f39d2ed9ef79a538eac49
MD5 8d3d5a1d29ddfb4fdbef90f09f9f54de
SHA1 a22da1d825e52f59f045c776a9d20393f74d8df0
SHA512 ea9d6d285d51fdc3848a8fa8834bb0775d297bf416985c507e5eaaf7fc290863defc1e126f361d35acee9b196e5da64e10b80cc12987738ffa12c2d3e3036757
SSDEEP 24576:WkQhavMUptl7Ko60OegX7AonnJXnMvQo:WkSodM0Ervnn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

303216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Denis\Desktop\cheats\nightflex\x64\Release\PisiValo.pdb

kernel32

GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter SetConsoleTitleA GetCurrentProcess SetConsoleScreenBufferSize GetStdHandle WriteFile DeviceIoControl SetConsoleWindowInfo CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CloseHandle CreateThread GetWindowsDirectoryW SystemTimeToFileTime GlobalMemoryStatusEx GetSystemTime lstrcmpiW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW GlobalFree GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalLock GlobalAlloc VirtualAlloc LocalFree

user32

EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture SetClipboardData SetCursor SetCapture LoadCursorW ClientToScreen GetCapture GetActiveWindow ScreenToClient GetClipboardData GetClientRect GetKeyState GetWindowThreadProcessId DefWindowProcW GetWindow DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetWindowTextA GetForegroundWindow TranslateMessage mouse_event SetWindowLongW PostQuitMessage FindWindowA UpdateWindow

shell32

ShellExecuteW

msvcp140

?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_terminate memcmp _CxxThrowException memset __C_specific_handler __current_exception_context __current_exception __std_exception_copy __std_exception_destroy strstr memchr

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _fseeki64 _set_fmode __stdio_common_vsscanf fputc __p__commode __stdio_common_vsprintf _wfopen fwrite fsetpos ungetc __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func setvbuf fread __stdio_common_vsprintf_s fgetpos ftell fgetc

api-ms-win-crt-string-l1-1-0

strcmp strncpy isprint

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

abort _configure_narrow_argv _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate system _get_initial_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _beginthreadex _c_exit __p___argv __p___argc exit _exit

api-ms-win-crt-math-l1-1-0

atanf ceilf tanf cosf __setusermatherr floorf fmodf pow powf sinf atan2f sqrtf asinf

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_dupenv_s