Mirage 1[.]5[.]exe | Triage

Sharing

General

Target

Mirage 1.5.exe
Size

71.9MB
MD5

48ff65c3e98faf87ba6459465e12f7f5
SHA1

016eac533150f0a4e89eab7931474997687bb259
SHA256

31bd89008ecaee68672f1ddb52925783b9617819d8c9aef7ebbdae458d66e65a
SHA512

5797b1ff7843b426b4cb0924b9926096d5bbe91612d95e174a631543972a6635aec1c96a88117f49767736c9477e9a34874a91577b1f742bf65a012d78f41e81
SSDEEP

1572864:ZhG/LzZS5uew52jdCypyJj9dqx6jn1W/G/TzDIp+broNgqG/LzZS5uew52jdCypk:TG/LzZS5uew52jdCypyJj9dqx6jn1W/l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Mirage 1.5.exe

Files

Mirage 1.5.exe
.exe windows:4 windows x86 arch:x86

fc9ae8768553a9930f55be6801914203

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
SetLastError
VirtualProtect
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
SetEnvironmentVariableW
CloseHandle
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW
OutputDebugStringW
GetFileAttributesW

user32

wsprintfW
MessageBoxA

ntdll

NtProtectVirtualMemory
NtClose
LdrLoadDll
RtlInitUnicodeString
NtMapViewOfSection
NtCreateSection
LdrGetProcedureAddress
NtUnmapViewOfSection

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ