AstraV6[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AstraV6.exe
Size 1.5MB
Sample260718-2twfeahv6w
SHA256 747c7a220fd30a8648a49cc8f6cda8da1a28e0114b35289f266c8ec3416fdba4
MD5 62dd1722c567e30e0d44b4e4866a0e56
SHA1 00e41be65163dd9a10d07e19bbfeadac48723905
SHA512 969a3a2be2983a849e6a58f39a01346eae13443108d2008002390e0045ff11eb046a10836cf2d0683b021489b1a757fbd4837225986d8357860d5bbd02e922e8
SSDEEP 24576:+QLyJf1KhITCgxaQZqdtPeES2E8Exsxi190NNbr:+QM1nuoqdkxb8Qp190
TLSH
T19C75AF42B2A941ECD07BE078D942F527E77178080F31AAEF17D049956F637F05ABAE12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AstraV6.exe

File Explorer

AstraV6.exe

.exe 1.5MB

AstraV6.exe

IMPHASH f8e3c405c7a0b8c8fff3ccafc7c2d33c
SHA256 747c7a220fd30a8648a49cc8f6cda8da1a28e0114b35289f266c8ec3416fdba4
MD5 62dd1722c567e30e0d44b4e4866a0e56
SHA1 00e41be65163dd9a10d07e19bbfeadac48723905
SHA512 969a3a2be2983a849e6a58f39a01346eae13443108d2008002390e0045ff11eb046a10836cf2d0683b021489b1a757fbd4837225986d8357860d5bbd02e922e8
SSDEEP 24576:+QLyJf1KhITCgxaQZqdtPeES2E8Exsxi190NNbr:+QM1nuoqdkxb8Qp190
TLSH
T19C75AF42B2A941ECD07BE078D942F527E77178080F31AAEF17D049956F637F05ABAE12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1001136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rayan\Downloads\98arot\ext_momentum\build\release.pdb

freetype

FT_New_Size FT_Done_Library FT_Get_Char_Index FT_Done_Size FT_Select_Charmap FT_Done_Face FT_GlyphSlot_Embolden FT_Render_Glyph FT_Add_Default_Modules FT_New_Library FT_GlyphSlot_Oblique FT_New_Memory_Face FT_Load_Glyph FT_Request_Size FT_Activate_Size

kernel32

GetFileAttributesExW SetConsoleCtrlHandler SetConsoleTitleA CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle ExitProcess GetModuleHandleW GetConsoleWindow IsDebuggerPresent GetModuleHandleA GetProcAddress SetThreadPriority GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter OpenProcess QueryFullProcessImageNameA GetCurrentProcess GetSystemInfo GetSystemTimeAsFileTime GetProcessTimes SetFileInformationByHandle K32EnumProcessModules ReadProcessMemory lstrcmpiW GetExitCodeProcess GetLastError MultiByteToWideChar LoadLibraryA VerSetConditionMask FreeLibrary GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock InitializeSListHead FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateFile2 VirtualAllocEx SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SetUnhandledExceptionFilter AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoA GetCurrentProcessId

user32

ClientToScreen ScreenToClient EnumWindows OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo SetCursorPos TrackMouseEvent GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics UnregisterClassW RegisterClassExW GetCapture GetAsyncKeyState FindWindowA SetWindowDisplayAffinity GetForegroundWindow MoveWindow SetLayeredWindowAttributes GetCursorPos DefWindowProcW CreateWindowExW ShowWindow DispatchMessageW PeekMessageW RegisterClassW TranslateMessage SendInput SetFocus LoadIconW LoadCursorW SetWindowLongW PostQuitMessage SetForegroundWindow GetWindowThreadProcessId keybd_event GetClassNameA GetWindowTextA GetClientRect

gdi32

CreateSolidBrush

comdlg32

GetOpenFileNameA

shell32

SHGetFolderPathA ShellExecuteW SHGetKnownFolderPath

ole32

CoInitialize CoInitializeEx CoCreateInstance CoTaskMemFree

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ _Cnd_wait _Cnd_broadcast ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

winmm

timeBeginPeriod

urlmon

URLDownloadToCacheFileW

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _purecall strchr strstr memcmp memchr memcpy memmove memset __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

strcpy_s tolower strncpy_s strcmp strlen strncmp strncpy _wcsicmp wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e exit _exit _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv system abort terminate _errno _register_onexit_function

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

fseek __acrt_iob_func _wfopen ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose fflush fputc __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsscanf

api-ms-win-crt-convert-l1-1-0

strtoll strtod strtoull atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

tanf _dsign logf ceilf powf fmodf acosf floorf atan2f expf roundf cosf sinf sqrtf nearbyint asinf __setusermatherr