Energy[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Energy.exe
Size

16.9MB
MD5

d76b4e5682378035899ae6da8aec5ab1
SHA1

2478b975ae7a2a4bc46b13be520fb4a08ac32027
SHA256

20d8a988223434011fbb86c00ef406f425b0f33c79857b19836f73d858c919db
SHA512

81d58f4837b0c85cfc6353278e67549631352908337d5d5caea187a168a11754049d25143571b255a56b9cd6865451a1f647ce1b8a8cf3f22cd1bb9693d50508
SSDEEP

393216:C2V5Z0ad4znIt6BqQcDZm3O8InNUhH++K:CuVL4Bqb8INqH3K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Energy.exe

Files

Energy.exe
.exe windows:6 windows x64 arch:x64

0f258f610258efa854807c3fcc961a5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MoveWindow

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

wininet

InternetReadFile

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-stdio-l1-1-0

fputc

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.(P8
Size: - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lln
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.#8^
Size: 16.9MB - Virtual size: 16.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f258f610258efa854807c3fcc961a5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

wininet

iphlpapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 172KB

.rdata Size: - Virtual size: 37KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 5KB

.(P8 Size: - Virtual size: 11.1MB

.lln Size: 3KB - Virtual size: 3KB

.#8^ Size: 16.9MB - Virtual size: 16.9MB

.reloc Size: 512B - Virtual size: 284B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 172KB

.rdata
Size: - Virtual size: 37KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 5KB

.(P8
Size: - Virtual size: 11.1MB

.lln
Size: 3KB - Virtual size: 3KB

.#8^
Size: 16.9MB - Virtual size: 16.9MB

.reloc
Size: 512B - Virtual size: 284B

.rsrc
Size: 512B - Virtual size: 469B