Myriad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Myriad.exe
Size 85KB
Sample260721-sdg4eadm3w
SHA256 3c34dc778bc4aeaf976c40e0460656414db231e1abef3c5dd175945cd6430a6b
MD5 046618e20f78bab5ae79ed11efe337aa
SHA1 8a761205b03fb74610f876e690d3d367506a75fd
SHA512 90fb6c4f933a2b4823faa086359adfd71dd0f299caf0c5cf2a5ab796ca31b32c8553275dd98beed308a0e8a58d302007ab73904730182ef26f07e9499773a6e7
SSDEEP 1536:921kQ8ad6QLln9iwDxk/u3lzTHR4Fm62OrE:MD8a9Lbi6mGZTHR4FD2OrE
TLSH
T109832A17A59800FCD077D2F9CAE35D42E3B3F41A037223DB13A2A5661F16AC65E7E912
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Myriad.exe

File Explorer

Myriad.exe

.exe 85KB

Myriad.exe

IMPHASH 2717753035e9f634cafcafb3ec6983ab
SHA256 3c34dc778bc4aeaf976c40e0460656414db231e1abef3c5dd175945cd6430a6b
MD5 046618e20f78bab5ae79ed11efe337aa
SHA1 8a761205b03fb74610f876e690d3d367506a75fd
SHA512 90fb6c4f933a2b4823faa086359adfd71dd0f299caf0c5cf2a5ab796ca31b32c8553275dd98beed308a0e8a58d302007ab73904730182ef26f07e9499773a6e7
SSDEEP 1536:921kQ8ad6QLln9iwDxk/u3lzTHR4Fm62OrE:MD8a9Lbi6mGZTHR4FD2OrE
TLSH
T109832A17A59800FCD077D2F9CAE35D42E3B3F41A037223DB13A2A5661F16AC65E7E912
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\retur\source\repos\Myriad Installer\x64\Release\Myriad Installer.pdb

kernel32

MultiByteToWideChar GetCurrentThreadId Sleep InitializeSListHead GetSystemTimeAsFileTime GetLocaleInfoEx FormatMessageA LocalFree WideCharToMultiByte GetFileInformationByHandleEx GetModuleHandleW GetLastError CloseHandle AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId

shell32

SHGetFolderPathA

ole32

CoUninitialize CoInitialize CoCreateInstance

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate memmove __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset memcpy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv terminate _initialize_narrow_environment abort _c_exit exit __p___argv __p___argc _initialize_onexit_table _exit _initterm_e _initterm _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function system

api-ms-win-crt-stdio-l1-1-0

_set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc __p__commode fgetpos __stdio_common_vsprintf fwrite fgetc fclose fflush fputc setvbuf

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen wcslen