obsidium-example[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
obsidium-example.exe
Size 1.2MB
Sample260707-e2nn7shx7y
SHA256 bb8911145753a6bca89b9795136083326b08a08cb88857ff324020e1bb99cae4
MD5 3e8df2fb345e746ffb2ba68424d629ea
SHA1 cf02fe02e5f8d30f150230d4d0c1abff05d7b7cb
SHA512 cd93de44cf3db8049787bc44245af2ee9cbeb86f2441113e46e82e5ab6257102c2cb54680ff835ed0fca406af00005945c8055e3b9caecc006bab577fa4a4ff2
SSDEEP 24576:FBMS7jxDKifBYgcGA9DHlxxvRoUiX7bIXBQI3rFVvpas8TzrEAhZ/uthF9/fP5z/:FBMmDKSpwcHhI3rFVvpas8TzAh1pn6xi
TLSH
T118459E69A7B942A8D1B7C278C6178213EAB2704C13319BDF47C98EA52F137E1573EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
obsidium-example.exe

File Explorer

obsidium-example.exe

.exe 1.2MB

obsidium-example.exe

IMPHASH 12ae01bfd4461479cc7f87d19c94c047
SHA256 bb8911145753a6bca89b9795136083326b08a08cb88857ff324020e1bb99cae4
MD5 3e8df2fb345e746ffb2ba68424d629ea
SHA1 cf02fe02e5f8d30f150230d4d0c1abff05d7b7cb
SHA512 cd93de44cf3db8049787bc44245af2ee9cbeb86f2441113e46e82e5ab6257102c2cb54680ff835ed0fca406af00005945c8055e3b9caecc006bab577fa4a4ff2
SSDEEP 24576:FBMS7jxDKifBYgcGA9DHlxxvRoUiX7bIXBQI3rFVvpas8TzrEAhZ/uthF9/fP5z/:FBMmDKSpwcHhI3rFVvpas8TzAh1pn6xi
TLSH
T118459E69A7B942A8D1B7C278C6178213EAB2704C13319BDF47C98EA52F137E1573EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ilzz\Desktop\development\obsidium-project\obsidium-example\x64\Release\obsidium-example.pdb

kernel32

WideCharToMultiByte WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle VerifyVersionInfoW VerSetConditionMask GetProcAddress GetModuleHandleW GetEnvironmentVariableA MultiByteToWideChar MoveFileExW LocalFree CreateFileW SetLastError GetLastError GetFileSizeEx QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepEx GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive Sleep FormatMessageA InitializeConditionVariable CloseHandle WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread InitializeCriticalSection GetSystemInfo WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetFullPathNameW

msvcp140

_Cnd_do_broadcast_at_thread_exit _Thrd_join _Query_perf_frequency _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock ?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_id ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z

ws2_32

accept WSAResetEvent ntohs WSAStartup WSAEventSelect __WSAFDIsSet WSACreateEvent WSAWaitForMultipleEvents WSACloseEvent send getsockopt WSACleanup WSAEnumNetworkEvents bind closesocket gethostname WSAGetLastError ioctlsocket connect getpeername sendto getsockname htons recv setsockopt socket recvfrom WSASetLastError WSAIoctl htonl freeaddrinfo select listen getaddrinfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException memcmp memcpy memmove memset strchr strrchr strstr __current_exception_context wcschr __current_exception __C_specific_handler memchr

api-ms-win-crt-runtime-l1-1-0

abort _crt_atexit terminate strerror_s _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _seh_filter_exe _beginthreadex _exit exit _initterm_e _errno _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type

api-ms-win-crt-math-l1-1-0

_fdopen __setusermatherr _dsign ceilf

api-ms-win-crt-heap-l1-1-0

malloc realloc calloc free _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fread __acrt_iob_func _lseeki64 __p__commode _set_fmode fwrite fclose _write _read _fileno fputs fgets ferror _close feof _fseeki64 _wfsopen _wsopen_s fseek ftell fflush fputc

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s strftime

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-string-l1-1-0

wcscpy_s wcsncpy_s wcsncmp strncmp strlen _strdup strspn wcslen strcspn strcmp strpbrk

api-ms-win-crt-filesystem-l1-1-0

_fullpath _fstat64 _wstat64 _unlink

api-ms-win-crt-utility-l1-1-0

bsearch qsort

advapi32

SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW