astro - pass 1[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

astro - pass 1.rar
Size

17.9MB
MD5

2d34c2c31ab2311a2069dca41685fe97
SHA1

e278bdff3e11d345fd2fcea734f549f218322f48
SHA256

afe33a2461331c3bdcf2dd06d1399aca5420d812a68adc092d269e7dfc9148ef
SHA512

7921043eb5fefb3eadfdf3fe97d639c52a7dd372ed93a33bd677e0604a547b6417844633a35bd7b5ac533d72234b108c2de594f7778bb8d9d817798a1eb3b9a9
SSDEEP

393216:+mzGmPMVzrg/VyCiz9G0WM63VnvFpReX6BJh:tJM9gdUpY3/g6Bz

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/astro injector.exe
unpack001/astro-release.dll

Files

astro - pass 1.rar
.rar

Password: 1
astro injector.exe
.exe windows:6 windows x64 arch:x64

Password: 1

d362aafb54ed8edc1a18374d1489fa73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\hax\ConsoleInjector\ConsoleInjector\release\ConsoleInjector.pdb

Imports

kernel32

SetConsoleTitleA
GetFullPathNameA
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
LoadLibraryA
Process32Next
WriteProcessMemory
LoadLibraryW
GetProcAddress
VirtualAllocEx
CreateRemoteThread
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
Process32First
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext

user32

GetWindowThreadProcessId
FindWindowA

advapi32

GetUserNameA

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
_CxxThrowException
__std_terminate
__std_exception_destroy
memmove
memset
memcpy
__C_specific_handler
memcmp
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

__p___argc
_seh_filter_exe
_set_app_type
terminate
_register_thread_local_exe_atexit_callback
_c_exit
exit
_exit
__p___argv
_initterm_e
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
system

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fopen
__p__commode
fclose

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strcmp

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
astro-release.dll
.dll windows:6 windows x64 arch:x64

Password: 1

5224a67026b0c518ba584082c84dc0ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadCursorA

advapi32

GetUserNameA

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

acosf

Sections

.text
Size: - Virtual size: 590KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.0m_
Size: - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.0NG
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

._P5
Size: 18.7MB - Virtual size: 18.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
password 1.txt
пароль 1.txt

Sharing

General

Malware Config

Signatures

Files

Password: 1

Password: 1

d362aafb54ed8edc1a18374d1489fa73

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 1020B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 120B

Password: 1

5224a67026b0c518ba584082c84dc0ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 590KB

.rdata Size: - Virtual size: 455KB

.data Size: - Virtual size: 144KB

.pdata Size: - Virtual size: 16KB

.0m_ Size: - Virtual size: 12.9MB

.0NG Size: 4KB - Virtual size: 3KB

._P5 Size: 18.7MB - Virtual size: 18.7MB

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 1020B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 120B

.text
Size: - Virtual size: 590KB

.rdata
Size: - Virtual size: 455KB

.data
Size: - Virtual size: 144KB

.pdata
Size: - Virtual size: 16KB

.0m_
Size: - Virtual size: 12.9MB

.0NG
Size: 4KB - Virtual size: 3KB

._P5
Size: 18.7MB - Virtual size: 18.7MB

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 512B - Virtual size: 469B