albania[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

albania.exe
Size

2.7MB
MD5

800c89d7436cd08817787fce77d3c135
SHA1

e07e87b63086f28711cf6d5cd06f99cce4a85d01
SHA256

1f2da5b2370d87173f69ae006bb53b1069ae9f0e6802f298905a3b2cd09dab86
SHA512

a578484189204ae1f27fb735aa10fdb2b07906bf0ba3b1b7b9c73df23faefeefdfcdea160eec9a9172a06e40cba97cf765ebfc7b44a39b4761230981d378d87d
SSDEEP

49152:zFJGtgztDZqhvK8T5BoRTfJh6pHfRMTMA/+JzadmXkgKha:+16Aadq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
albania.exe

Files

albania.exe
.exe windows:6 windows x64 arch:x64

be99e1583cc8b5f7395bb5b06cff4a60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

albania.pdb

Imports

ntdll

NtRaiseHardError
NtCancelIoFileEx
RtlPcToFileHeader
RtlAdjustPrivilege
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCreateFile
RtlUnwindEx

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

user32

MessageBoxW
SystemParametersInfoW

kernel32

SetHandleInformation
GetQueuedCompletionStatusEx
GetCurrentThreadId
PostQueuedCompletionStatus
GetSystemTimeAsFileTime
RaiseException
SetFileCompletionNotificationModes
lstrlenW
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
LoadLibraryExW
GetStdHandle
GetCurrentProcessId
TerminateProcess
QueryPerformanceFrequency
HeapFree
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
CreateFileW
GetFinalPathNameByHandleW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetConsoleMode
TlsAlloc
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
TlsGetValue
CloseHandle
TlsSetValue
IsProcessorFeaturePresent
CreateIoCompletionPort
TlsFree
FreeLibrary

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

secur32

ApplyControlToken
AcceptSecurityContext
EncryptMessage
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextW
FreeContextBuffer
QueryContextAttributesW
AcquireCredentialsHandleA
DecryptMessage

ws2_32

recv
shutdown
getsockopt
ioctlsocket
connect
bind
send
WSASend
WSASocketW
getpeername
getsockname
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
closesocket
freeaddrinfo
getaddrinfo

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertOpenStore
CertDuplicateStore

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp

api-ms-win-crt-runtime-l1-1-0

exit
_c_exit
_initterm_e
_exit
_set_app_type
_initterm
_seh_filter_exe
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
abort
_initialize_narrow_environment
_cexit
_configure_narrow_argv
__p___argv
_register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_set_new_mode

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 930KB - Virtual size: 930KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be99e1583cc8b5f7395bb5b06cff4a60

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

kernel32

advapi32

secur32

ws2_32

crypt32

shell32

ole32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 930KB - Virtual size: 930KB

.data Size: 12KB - Virtual size: 14KB

.pdata Size: 96KB - Virtual size: 96KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 930KB - Virtual size: 930KB

.data
Size: 12KB - Virtual size: 14KB

.pdata
Size: 96KB - Virtual size: 96KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 18KB - Virtual size: 18KB