illusion[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
illusion.exe
Size 61.6MB
Sample260721-eqa9qsew2k
SHA256 b4da32ba5a9f2b9f40aaa6381c9e4cc699cfd7f9704ef19e848a4d3cf6152a0d
MD5 73d04213d81da428612b64ebff169d69
SHA1 20a279042f9909f29b1f13a41caf0315b9c0e4bd
SHA512 bdb531bdfac9e05b42ff4e0378b8b1d00d007b48a8cfa495ce6e89ed8b647ae422ffe71d2d66c60cdfd71469f57fd38485ed8eb5e17bb7cb4493980540f48f5a
SSDEEP 393216:FeZmoWVLVQtH7baXUs7koKFdu9CwJsv6t+5/3Wpau61EsZJ/ZcYsQCbR5vuYqNrK:gS+s7EMpY17ZJ/3rnOT2F9
TLSH
T187E76B5663F40195E5B7D138CA6B4602D7B2B84153618BCF326CDA681F73BE22E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
illusion.exe

File Explorer

illusion.exe

.exe 61.6MB

illusion.exe

IMPHASH 3b44e09a766a4c77dd14ad6b59fb0c8a
SHA256 b4da32ba5a9f2b9f40aaa6381c9e4cc699cfd7f9704ef19e848a4d3cf6152a0d
MD5 73d04213d81da428612b64ebff169d69
SHA1 20a279042f9909f29b1f13a41caf0315b9c0e4bd
SHA512 bdb531bdfac9e05b42ff4e0378b8b1d00d007b48a8cfa495ce6e89ed8b647ae422ffe71d2d66c60cdfd71469f57fd38485ed8eb5e17bb7cb4493980540f48f5a
SSDEEP 393216:FeZmoWVLVQtH7baXUs7koKFdu9CwJsv6t+5/3Wpau61EsZJ/ZcYsQCbR5vuYqNrK:gS+s7EMpY17ZJ/3rnOT2F9
TLSH
T187E76B5663F40195E5B7D138CA6B4602D7B2B84153618BCF326CDA681F73BE22E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

FormatMessageA GetLocaleInfoEx GetStartupInfoW SetUnhandledExceptionFilter SizeofResource GetCommandLineW GetEnvironmentVariableW GetTempPathW WaitForSingleObject LockResource CloseHandle LoadResource FindResourceW LocalFree GetExitCodeProcess CreateDirectoryW FindClose GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW InitializeSListHead FindFirstFileW GetLastError

user32

MessageBoxW

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp _CxxThrowException memset __std_exception_copy __std_exception_destroy memmove __std_terminate __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-stdio-l1-1-0

fsetpos ungetc setvbuf fgetpos fwrite _fseeki64 _get_stream_buffer_pointers fgetc fclose fflush _set_fmode fputc fread __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _crt_atexit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv terminate _set_app_type _seh_filter_exe _register_onexit_function abort _initialize_onexit_table _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strlen