Oblivion[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Oblivion.exe
Size 8.3MB
Sample260717-e6qpcsew5s
SHA256 6a0cfa65b53ac8bc1d3f1d598d09d381a95c633a49bcb9c7f72098659e403b1d
MD5 154b59ff64f1adf01f673c0939890da6
SHA1 6e744f50d9c2b3fc9bac898aaca504fc26ef9c8d
SHA512 8bbca170e3701271f2f3fe9a697bb01f5e70b9edfb58e9b75979a29481c85b542fb93ade9c9985aab71221b8236b31635900327176b725880a129570adc7db52
SSDEEP 196608:+u6pRMBUk0GtaqG0xiz/abGBiIQ/vOhr7Fvk:++zaemeG0L/vOV+
TLSH
T1D896CE61A6AC4AADF036B039C1975617A7F17C0D1730CFCB96D04DAB0E2F6E0B56A709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oblivion.exe

File Explorer

Oblivion.exe

.exe 8.3MB

Oblivion.exe

IMPHASH e07f4788ceb15d6c85f4c2f6ff816ce7
SHA256 6a0cfa65b53ac8bc1d3f1d598d09d381a95c633a49bcb9c7f72098659e403b1d
MD5 154b59ff64f1adf01f673c0939890da6
SHA1 6e744f50d9c2b3fc9bac898aaca504fc26ef9c8d
SHA512 8bbca170e3701271f2f3fe9a697bb01f5e70b9edfb58e9b75979a29481c85b542fb93ade9c9985aab71221b8236b31635900327176b725880a129570adc7db52
SSDEEP 196608:+u6pRMBUk0GtaqG0xiz/abGBiIQ/vOhr7Fvk:++zaemeG0L/vOV+
TLSH
T1D896CE61A6AC4AADF036B039C1975617A7F17C0D1730CFCB96D04DAB0E2F6E0B56A709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8642560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileA D3DX11GetImageInfoFromFileA

winmm

mciSendStringA PlaySoundW timeBeginPeriod

ntdll

RtlUnwindEx RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext VerSetConditionMask RtlVirtualUnwind RtlUnwind

kernel32

SetPriorityClass GetCurrentProcess SetThreadPriority UnmapViewOfFile SetEvent GetCurrentThread CreateFileMappingA GetModuleHandleW CreateEventA MapViewOfFile K32EnumProcessModulesEx OpenProcess Process32NextW K32GetModuleBaseNameW Process32FirstW K32GetModuleInformation VirtualAllocEx VirtualFreeEx GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx VirtualProtect FindNextFileW WriteFile SetEndOfFile FindClose CreateFileW ExitThread SetFilePointerEx ExitProcess GetCurrentProcessId CreateProcessW VirtualQuery FlushFileBuffers GetCommandLineW ProcessIdToSessionId WriteProcessMemory GetExitCodeThread LoadLibraryW VirtualProtectEx ReadProcessMemory SizeofResource LockResource LoadResource FindResourceW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetLocalTime LoadLibraryExW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent TerminateProcess IsProcessorFeaturePresent WriteConsoleW GetFileType GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI HeapReAlloc CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx LocalFree IsValidCodePage QueryPerformanceCounter FreeLibrary IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA CreateRemoteThread WaitForSingleObject GetModuleFileNameW GetTickCount GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter Module32NextW Module32FirstW CloseHandle GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SleepConditionVariableSRW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize OutputDebugStringW GetConsoleOutputCP ReadConsoleW GetConsoleMode RaiseException GetSystemInfo LoadLibraryExA InitOnceComplete InitOnceBeginInitialize FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId

user32

MapVirtualKeyW GetKeyboardState ToUnicode SetWindowDisplayAffinity GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible EnumWindows GetClassNameW GetWindowTextW GetWindowLongW DestroyWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow IsWindow GetMonitorInfoW IsChild MoveWindow SetLayeredWindowAttributes BringWindowToTop LoadIconW UpdateWindow GetWindowRect SetWindowPos SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints GetRawInputData ClipCursor SetForegroundWindow DefWindowProcW GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayDevicesA MessageBoxW DispatchMessageW PeekMessageW TranslateMessage SetCursor GetClientRect GetAsyncKeyState RegisterRawInputDevices UnregisterClassW

advapi32

RegOpenKeyExW RegQueryValueExA RegCloseKey RegDeleteValueA RegOpenKeyExA AdjustTokenPrivileges RevertToSelf SetTokenInformation ImpersonateLoggedOnUser CreateProcessAsUserW DuplicateTokenEx GetTokenInformation LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd082

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Oblivion.exe

d3dcompiler_43

d3dx11_43

winmm

ntdll

kernel32

user32

advapi32

shell32

imm32

generic