archangels[.]exe | Triage™

General

Target
archangels.exe
Size 14KB
Sample260722-pb7dqs1sft
SHA256 1c820baa12fe46877aec8d937a3f5f23ef9b368b29b512c00d6041793e7d77ac
MD5 c4c425737aff1ae983df93df11b4c59b
SHA1 eb9b36c4e3f47fdb7cc9db3cd0df826ae56b0dba
SHA512 7008827df3a92d2c98d17e856846707b99f94c89362d8305698c512be16630233df0631cee2385229d001517b448e20863d8d195cd8026fdcc8157542b0f211f
SSDEEP 192:UySLHSl/2jGoxd+hJbMN5YK1EzOPNp9aop+Xs5pZFfkAVVS73Q5tfLsJT:UdLyl/QGoz+DMzEzOlb23v
TLSH
T1F9622A86B38A0CF5EA7541B982B31A08F2B5FB39077187CF4350A10D1DE97E1BD72189
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
archangels.exe

File Explorer

archangels.exe

.exe 14KB

archangels.exe

IMPHASH 13d60919a7a52a8a9e36634a7c8a326f
SHA256 1c820baa12fe46877aec8d937a3f5f23ef9b368b29b512c00d6041793e7d77ac
MD5 c4c425737aff1ae983df93df11b4c59b
SHA1 eb9b36c4e3f47fdb7cc9db3cd0df826ae56b0dba
SHA512 7008827df3a92d2c98d17e856846707b99f94c89362d8305698c512be16630233df0631cee2385229d001517b448e20863d8d195cd8026fdcc8157542b0f211f
SSDEEP 192:UySLHSl/2jGoxd+hJbMN5YK1EzOPNp9aop+Xs5pZFfkAVVS73Q5tfLsJT:UdLyl/QGoz+DMzEzOlb23v
TLSH
T1F9622A86B38A0CF5EA7541B982B31A08F2B5FB39077187CF4350A10D1DE97E1BD72189
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\AURORA\source\repos\archangels\x64\Release\archangels.pdb

kernel32

CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Sleep GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW

user32

MessageBoxA

msvcp140

?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Query_perf_frequency ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Query_perf_counter ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __current_exception memcpy __C_specific_handler __current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp

api-ms-win-crt-runtime-l1-1-0

terminate _register_onexit_function _initialize_onexit_table _crt_atexit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _seh_filter_exe _exit exit _initterm_e _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing