solaris[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

solaris.exe
Size

18.7MB
MD5

cbd3a562b665afc70463a5a9d406705d
SHA1

b996301ca24b209de1de67d8724d8f49cb1b2a60
SHA256

3343a540d57129e70a5a4f40e517c90ce57cd1d8be9edaf04741908a8dfe9a83
SHA512

44c8cea31f3ee89d906750d8e182a3bf760dc8559c8201ec815be28209798d0ae408cb159d0138f5f9db0646764aea9f707127d14052f61714b12c937bf31f78
SSDEEP

393216:y5FwKgA5r8UNWD8c/+AvCN9oEmsCEId2oaq:y5Fw5GpC82+AvXEm71d8q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
solaris.exe

Files

solaris.exe
.exe windows:6 windows x64 arch:x64

10d8a87278a0844937ff3e98e28c9477

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiDestroyDeviceInfoList

kernel32

Process32FirstW

user32

SendMessageA

advapi32

CryptEncrypt

shell32

ShellExecuteA

ole32

StringFromGUID2

dpp

?set_timestamp@embed@dpp@@QEAAAEAU12@_J@Z

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmReleaseContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

normaliz

IdnToAscii

wldap32

ord22

crypt32

CertEnumCertificatesInStore

ws2_32

sendto

shlwapi

PathRemoveFileSpecA

rpcrt4

UuidCreate

ntdll

NtQuerySystemInformation

urlmon

URLDownloadToFileA

mpr

WNetGetProviderNameA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

dbghelp

SymCleanup

vcruntime140

memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-stdio-l1-1-0

_lseeki64

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-time-l1-1-0

_difftime64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-environment-l1-1-0

_dupenv_s

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pWQ
Size: - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bw'
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.F`y
Size: 18.7MB - Virtual size: 18.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10d8a87278a0844937ff3e98e28c9477

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

user32

advapi32

shell32

ole32

dpp

msvcp140

imm32

d3dcompiler_43

dwmapi

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

ntdll

urlmon

mpr

d3dx11_43

d3d11

dbghelp

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: - Virtual size: 1.3MB

.rdata Size: - Virtual size: 348KB

.data Size: - Virtual size: 2.8MB

.pdata Size: - Virtual size: 58KB

.pWQ Size: - Virtual size: 10.9MB

.bw' Size: 1024B - Virtual size: 632B

.F`y Size: 18.7MB - Virtual size: 18.7MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.3MB

.rdata
Size: - Virtual size: 348KB

.data
Size: - Virtual size: 2.8MB

.pdata
Size: - Virtual size: 58KB

.pWQ
Size: - Virtual size: 10.9MB

.bw'
Size: 1024B - Virtual size: 632B

.F`y
Size: 18.7MB - Virtual size: 18.7MB

.rsrc
Size: 512B - Virtual size: 480B