sefirah[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sefirah.exe
Size 1.1MB
Sample260507-tnftrsfx5x
SHA256 ba67720dd115293ec5a12d08be6b0ee982227a4c5e4662fb89269c76556df6e0
MD5 f36a662ca22f1934e3a56f111e6df191
SHA1 c097d4c7cdec0c6e8aff8ef5d408cd8bb2f40d2d
SHA512 7760fd0a14d2c743f1f5a30505008241323b663362fec449e30b98a9f7033e605e8a13f0e4d2806af92a065846e0493ed503be8d746964afad0f6215f3696b73
SSDEEP 24576:XLlOwglvD5liDfOdt0n8P02fWjutiBm8UK92IJE:XJOwgFiDfM08P0gUBm8UKwIJE
TLSH
T15935C651D1059AAFFF14C0722E96B071606C7BBB08BCA0BD52E97D7BAA07EF0C5051B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sefirah.exe

File Explorer

sefirah.exe

.exe 1.1MB

sefirah.exe

IMPHASH be39bc473662d41aed49363b3dc53a8e
SHA256 ba67720dd115293ec5a12d08be6b0ee982227a4c5e4662fb89269c76556df6e0
MD5 f36a662ca22f1934e3a56f111e6df191
SHA1 c097d4c7cdec0c6e8aff8ef5d408cd8bb2f40d2d
SHA512 7760fd0a14d2c743f1f5a30505008241323b663362fec449e30b98a9f7033e605e8a13f0e4d2806af92a065846e0493ed503be8d746964afad0f6215f3696b73
SSDEEP 24576:XLlOwglvD5liDfOdt0n8P02fWjutiBm8UK92IJE:XJOwgFiDfM08P0gUBm8UKwIJE
TLSH
T15935C651D1059AAFFF14C0722E96B071606C7BBB08BCA0BD52E97D7BAA07EF0C5051B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps GetStockObject

imm32

ImmGetContext ImmReleaseContext

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryW CreateFileMappingA CreateFileW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtWriteFile RtlNtStatusToDosError

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit

shell32

SHGetFolderPathW SHGetKnownFolderPath ShellExecuteW

shlwapi

PathCombineW PathFileExistsW

user32

GetDC GetDesktopWindow GetSystemMetrics MessageBoxW ReleaseDC

uxtheme

IsAppThemed IsThemeActive

version

GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeGetTime

winspool.drv

EnumPrintersW

ws2_32

WSACleanup WSAStartup

Name

.text

Size

519KB

Virtual Size

518KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

532KB

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sefirah.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

comctl32

comdlg32

gdi32

imm32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

shlwapi

user32

uxtheme

version

winmm

winspool.drv

ws2_32

generic