Polaris Beta[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Polaris Beta.exe
Size 6.5MB
Sample260714-pr49bacz2l
SHA256 6f973bd227df297bd3be2d92123fc2e5e263bf4b3094278b0240dd527804b518
MD5 21dcdd8e7a37855a1375f441d1ab1e37
SHA1 f323e3abd975101e087e3c1574b30d534e0d5448
SHA512 e118b377f59d5356c13d428b6bfff9bf30b78bb2a3f983a0e0665400a607149eac7336ab885b33df82a7aac95e419ce32317337fa4291388d03b107b17a1dbd3
SSDEEP 196608:+vfFi/ad23UTok0sTYdQ/v1Qj/WCTKnBi:+voz3U0k0ss6/v1QjW9n0
TLSH
T11D66EF42F283C140C8568D3A8D46E9D6D7317849AF0617A73284BF1E6EF77C2AE7A741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Polaris Beta.exe

File Explorer

Polaris Beta.exe

.exe 6.5MB

Polaris Beta.exe

IMPHASH a59513ac5bf5037ed5f2c0a10f19c662
SHA256 6f973bd227df297bd3be2d92123fc2e5e263bf4b3094278b0240dd527804b518
MD5 21dcdd8e7a37855a1375f441d1ab1e37
SHA1 f323e3abd975101e087e3c1574b30d534e0d5448
SHA512 e118b377f59d5356c13d428b6bfff9bf30b78bb2a3f983a0e0665400a607149eac7336ab885b33df82a7aac95e419ce32317337fa4291388d03b107b17a1dbd3
SSDEEP 196608:+vfFi/ad23UTok0sTYdQ/v1Qj/WCTKnBi:+voz3U0k0ss6/v1QjW9n0
TLSH
T11D66EF42F283C140C8568D3A8D46E9D6D7317849AF0617A73284BF1E6EF77C2AE7A741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1115600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\stellarix\Desktop\andybot2\roblox-ext\roblox-ext\x64\Release\roblox-ext.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

timeEndPeriod PlaySoundW timeBeginPeriod

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpCloseHandle WinHttpQueryDataAvailable

kernel32

GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockShared SetUnhandledExceptionFilter GetModuleHandleA CloseHandle GetProcAddress SetThreadPriority Sleep GetCurrentThread QueryPerformanceFrequency SwitchToThread QueryPerformanceCounter GetCurrentProcess GetSystemInfo GetCurrentProcessId GetProcessTimes GetEnvironmentVariableA CreateDirectoryA GetLocaleInfoA MultiByteToWideChar LoadLibraryA FreeLibrary GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameW WaitForSingleObject CreateProcessW GetModuleHandleW OpenProcess CreateToolhelp32Snapshot Process32NextW Module32FirstW ReadProcessMemory CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA InitializeSListHead GetSystemTimeAsFileTime

user32

DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW GetMonitorInfoW PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage FindWindowA UpdateWindow SetForegroundWindow OpenClipboard CloseClipboard GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetCursorPos GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetWindowDisplayAffinity GetAsyncKeyState SetCursorPos SendInput

msvcp140

_Thrd_join _Thrd_id _Cnd_wait _Cnd_signal ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_lock ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Cnd_broadcast ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memset __std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memcmp

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _beginthreadex terminate _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fclose _set_fmode ftell __p__commode _wfopen __stdio_common_vfprintf fflush __acrt_iob_func fwrite __stdio_common_vsscanf fseek __stdio_common_vsprintf fread fopen_s

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-math-l1-1-0

pow powf ldexp sqrtf sqrt fmodf logf log ceilf tanf acosf cosf atan2f roundf sinf __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s strncpy strcmp strncmp tolower strlen

api-ms-win-crt-time-l1-1-0

_localtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale