Kristonium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Kristonium.exe
Size 231KB
Sample260416-stlrjafz21
SHA256 d0b5b5b6b6a9c1b5743a73c30b02d98080e87c03fc3d6a58373aa5f55a9eba49
MD5 515c95f749b333836cc295097a010f77
SHA1 e1c5cac8c951e9df6ad5214a0079a0d1fcb3fe39
SHA512 9f2efbf991cef649edd3d64a59cafa0f3e91216725693147ddb2f3daab77fe34772f1a1c71ebb18b43d5801724353a932de254ffeaf522c158b524eb7bdabb20
SSDEEP 3072:eVxO0llDQ4psyidxHZFPYRzv3BNIu8uwZBcifH8Wpy9z:eVxOQljidxHZFPYRzv3BNJVwfcm8t
TLSH
T107348E18F3C0D485DCA22D384DA0DA79123B7D6C2B0B924B36E4BE1FBF756526C5C25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kristonium.exe

File Explorer

Kristonium.exe

.exe 231KB

Kristonium.exe

IMPHASH 5af4dd2c2d72e587aef2dab0963db458
SHA256 d0b5b5b6b6a9c1b5743a73c30b02d98080e87c03fc3d6a58373aa5f55a9eba49
MD5 515c95f749b333836cc295097a010f77
SHA1 e1c5cac8c951e9df6ad5214a0079a0d1fcb3fe39
SHA512 9f2efbf991cef649edd3d64a59cafa0f3e91216725693147ddb2f3daab77fe34772f1a1c71ebb18b43d5801724353a932de254ffeaf522c158b524eb7bdabb20
SSDEEP 3072:eVxO0llDQ4psyidxHZFPYRzv3BNIu8uwZBcifH8Wpy9z:eVxOQljidxHZFPYRzv3BNJVwfcm8t
TLSH
T107348E18F3C0D485DCA22D384DA0DA79123B7D6C2B0B924B36E4BE1FBF756526C5C25A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27065

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\HP Pavilion\source\repos\Kristonium\Release\Kristonium.pdb

kernel32

UnhandledExceptionFilter GetCurrentProcess SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW ExitProcess GetProcAddress CreateThread LoadLibraryW CloseHandle LoadLibraryA TerminateThread Sleep CreateFileW WriteFile GetCurrentThreadId

user32

DrawIcon ExitWindowsEx LoadIconW DrawIconEx GetDesktopWindow InvalidateRect MessageBoxW GetWindowRect ReleaseDC GetCursorPos GetDC GetSystemMetrics

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC PatBlt StretchBlt PlgBlt CreatePolygonRgn DeleteDC SetTextColor TextOutA SetBkMode Ellipse DeleteObject InvertRgn CreateSolidBrush RoundRect

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

ShellExecuteA

winmm

waveOutWrite waveOutPrepareHeader waveOutOpen waveOutClose PlaySoundW waveOutUnprepareHeader

msimg32

AlphaBlend

vcruntime140

_except_handler4_common memset

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-math-l1-1-0

cbrt _libm_sse2_cos_precise _libm_sse2_tan_precise roundf _libm_sse2_sin_precise _CIfmod __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s terminate _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _c_exit _cexit _get_narrow_winmain_command_line _exit exit _initterm_e _initterm _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kristonium.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

msimg32

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic