chaos[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
chaos.exe
Size 81KB
Sample260710-flel2aev7s
SHA256 c34c9cf80299c441ac46449604d8b03e712b3a6deaefd00622600839ccff6437
MD5 bce621a7347ba7894897f37ac2acacce
SHA1 ecc31519ddd11d505ae2fce671e93db26ac946ce
SHA512 7586812df7823434df9e042bec9f69c3e6f6f69f399d668d487f0cc60f75a2aac2ca009e803a2ffd417b39bcf36ed5722bc9d018761200f8d54b8d8df0e4e725
SSDEEP 1536:Miho4xLjQdXmR1oDPpMTiN+hKdYt6TpmNP1STfAz9IguzsKs4AVzvzMWIo:O4JjQd01o9VNqKdY+8V1STfqIgYsKs4V
TLSH
T152835D33F9169433D3445AF095A6AF66CA7AFCB28BA0A4C3B7C05EE644146C57F34A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chaos.exe

File Explorer

chaos.exe

.exe .ps1 81KB

chaos.exe

IMPHASH ef66b0c10bf14443c9eaef1ca3dc3392
SHA256 c34c9cf80299c441ac46449604d8b03e712b3a6deaefd00622600839ccff6437
MD5 bce621a7347ba7894897f37ac2acacce
SHA1 ecc31519ddd11d505ae2fce671e93db26ac946ce
SHA512 7586812df7823434df9e042bec9f69c3e6f6f69f399d668d487f0cc60f75a2aac2ca009e803a2ffd417b39bcf36ed5722bc9d018761200f8d54b8d8df0e4e725
SSDEEP 1536:Miho4xLjQdXmR1oDPpMTiN+hKdYt6TpmNP1STfAz9IguzsKs4AVzvzMWIo:O4JjQd01o9VNqKdY+8V1STfqIgYsKs4V
TLSH
T152835D33F9169433D3445AF095A6AF66CA7AFCB28BA0A4C3B7C05EE644146C57F34A13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\user\Desktop\gay\module\Release\module.pdb

kernel32

InitializeCriticalSection SetSystemTime CreateMutexW FindClose ReleaseMutex Sleep GetLastError GetSystemDirectoryA FreeConsole CreateThread SetFileAttributesA GetLogicalDriveStringsA Beep FindNextFileA ExitProcess CopyFileW GetConsoleWindow CreateDirectoryA GetSystemTime GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection GetDriveTypeA InitializeSListHead GetModuleFileNameW EnterCriticalSection FindFirstFileA DeleteCriticalSection MoveFileA

user32

TranslateMessage UnhookWindowsHookEx BlockInput DispatchMessageW ChangeDisplaySettingsW ShowWindow SendMessageW GetMessageW FindWindowW LoadCursorW GetCursorPos ReleaseDC SetCursorPos SwapMouseButton SetSystemCursor SystemParametersInfoW SetWindowsHookExW CallNextHookEx GetDC MessageBoxW InvertRect keybd_event

advapi32

RegOpenKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHFileOperationA SHGetFolderPathA ShellExecuteW

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Xbad_alloc@std@@YAXXZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

iphlpapi

GetAdaptersInfo

ws2_32

sendto htons socket WSAStartup inet_pton closesocket WSACleanup

netapi32

NetApiBufferFree NetUserEnum NetUserSetInfo

winmm

mciSendStringW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

vcruntime140

_except_handler4_common _CxxThrowException __current_exception_context __current_exception memset memmove memcpy __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-stdio-l1-1-0

fgetpos __p__commode fputc fflush fclose setvbuf _set_fmode __stdio_common_vswprintf fgetc _get_stream_buffer_pointers _fseeki64 fwrite fread fsetpos ungetc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-runtime-l1-1-0

_controlfp_s _wsystem terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initterm _get_narrow_winmain_command_line system _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale