avarion[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
avarion.exe
Size 24KB
Sample260511-bf5ttact8l
SHA256 01b7dd524ab1a2fbb6f9bf502092891a89758e5863f469fee2acbd8cfc5c217d
MD5 4842d9270ff567cce80265d86704a317
SHA1 22e4f88865ec29e887382d5f88adef921eceee9b
SHA512 ac3f94a5fd75f66684072787c0561e584bf5946ddb9c468a1f7d172245131c625b1851c58cadc2f07599d7dae1899e224b14b5e244d357dbf2dca7fa78cb5866
SSDEEP 384:6/9AGVoHYIsewXOM0noHFKDUfRjhwJGwSRRhV53cY:6ZVoHPMHIU5mJIX73c
TLSH
T1E5B23C56675A04DCC57753B8C4A31E12C3B2B9282B71A7CF4B91D2560F292E1F87EF06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
avarion.exe

File Explorer

avarion.exe

.exe 24KB

avarion.exe

IMPHASH 2e22f53d9001bc875b0fdd543f52ddd0
SHA256 01b7dd524ab1a2fbb6f9bf502092891a89758e5863f469fee2acbd8cfc5c217d
MD5 4842d9270ff567cce80265d86704a317
SHA1 22e4f88865ec29e887382d5f88adef921eceee9b
SHA512 ac3f94a5fd75f66684072787c0561e584bf5946ddb9c468a1f7d172245131c625b1851c58cadc2f07599d7dae1899e224b14b5e244d357dbf2dca7fa78cb5866
SSDEEP 384:6/9AGVoHYIsewXOM0noHFKDUfRjhwJGwSRRhV53cY:6ZVoHPMHIU5mJIX73c
TLSH
T1E5B23C56675A04DCC57753B8C4A31E12C3B2B9282B71A7CF4B91D2560F292E1F87EF06
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

UpdateProcThreadAttribute OpenProcess GetModuleFileNameW LocalAlloc InitializeProcThreadAttributeList CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateProcessW TerminateProcess GetCurrentProcess CreateEventW WaitForSingleObject GetLastError CloseHandle WaitForDebugEvent LocalFree ContinueDebugEvent SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

advapi32

CreateProcessWithTokenW LookupPrivilegeValueW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority DuplicateTokenEx CreateWellKnownSid AdjustTokenPrivileges OpenProcessToken

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?width@ios_base@std@@QEAA_J_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

ntdll

DbgUiSetThreadDebugObject NtRemoveProcessDebug NtQueryInformationProcess NtDuplicateObject

rpcrt4

RpcBindingFromStringBindingW RpcAsyncInitializeHandle RpcAsyncCompleteCall NdrAsyncClientCall RpcStringFreeW RpcStringBindingComposeW RpcBindingSetAuthInfoExW

vcruntime140

_CxxThrowException __std_exception_destroy memcpy memset __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e _initterm __p___argv _get_initial_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _set_app_type __p___argc _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale