Pirmas[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Pirmas.exe
Size 24KB
Sample241012-w6sbmayhll
SHA256 733890f26201c4b626e4f3c1852159cc934fd5dc689c7d488c9e94219e6c9828
MD5 bce0cee3c3c8d193e11e9158cc8fd19c
SHA1 1154febbb1e0cae8234a759d9c3c7cd50878a56e
SHA512 944e8fc45c2fc3f5ff768d98cf9902e73aac3e599e80f2879eaa4a3249d04463d251e0f7ef6ecff1d72c19be1310a3f7fb64947027505b72c0773516ceeb9b7a
SSDEEP 384:PWiQIk95AugPN/LYXuhLZGPjCsfSxJsB7RIyEejoRkifr/Q3kq1yz/hLRm:pF/LRLZGPjbSHsBV3EeKkM/Q3Ry
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pirmas.exe

File Explorer

Pirmas.exe

.exe 24KB

Pirmas.exe

IMPHASH 0836b5cec702c746a60ff8b9ec2bcb91
SHA256 733890f26201c4b626e4f3c1852159cc934fd5dc689c7d488c9e94219e6c9828
MD5 bce0cee3c3c8d193e11e9158cc8fd19c
SHA1 1154febbb1e0cae8234a759d9c3c7cd50878a56e
SHA512 944e8fc45c2fc3f5ff768d98cf9902e73aac3e599e80f2879eaa4a3249d04463d251e0f7ef6ecff1d72c19be1310a3f7fb64947027505b72c0773516ceeb9b7a
SSDEEP 384:PWiQIk95AugPN/LYXuhLZGPjCsfSxJsB7RIyEejoRkifr/Q3kq1yz/hLRm:pF/LRLZGPjbSHsBV3EeKkM/Q3Ry
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Zack\source\repos\ion\x64\Release\ion.pdb

kernel32

VirtualQueryEx ReadProcessMemory CloseHandle OpenProcess GetStdHandle GetCurrentProcess SetConsoleTextAttribute RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

advapi32

AdjustTokenPrivileges CloseServiceHandle LookupPrivilegeValueA OpenSCManagerA OpenProcessToken QueryServiceStatusEx OpenServiceA

msvcp140

?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset _CxxThrowException __C_specific_handler __current_exception_context __current_exception __std_terminate __std_exception_copy __std_exception_destroy memcpy memchr memcmp

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function __p___argv _initialize_onexit_table _crt_atexit _cexit _c_exit _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe terminate _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn __p___argc

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale