eris[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
eris.exe
Size 1.2MB
Sample260726-zyfjmsdn8x
SHA256 b816b9b86757a197b00ed1434a31d6a7911c55e9ad97009eabff921050b2c252
MD5 cfa4415d4eb09b05280397d7155daa4d
SHA1 73aa38a1cd0d3c0ce60249366151a41811a24773
SHA512 cc698cbc496d4cba3e182eeaffe52f3a410096c2939c8b94b2cdc683d471c6cbc84b9f1b79a4cb573d6536215b36e1eb9440bcd2837577588164a28d6fe0c04d
SSDEEP 12288:qRbitXt/Xg9zuj9Sg4w0ykpijY5MdLMnfW19ySLWUK9dr18Sil25sCJD:6b6XWza9SyLMnfW1X0+nCJ
TLSH
T1D8459F81F2D38AABD261B1B4E92A632BFD74F415173441EF33800921DFB69D0AE75B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eris.exe

File Explorer

eris.exe

.exe 1.2MB

eris.exe

IMPHASH 9f57355b9d3aab7d8ab3ee85cebc5d62
SHA256 b816b9b86757a197b00ed1434a31d6a7911c55e9ad97009eabff921050b2c252
MD5 cfa4415d4eb09b05280397d7155daa4d
SHA1 73aa38a1cd0d3c0ce60249366151a41811a24773
SHA512 cc698cbc496d4cba3e182eeaffe52f3a410096c2939c8b94b2cdc683d471c6cbc84b9f1b79a4cb573d6536215b36e1eb9440bcd2837577588164a28d6fe0c04d
SSDEEP 12288:qRbitXt/Xg9zuj9Sg4w0ykpijY5MdLMnfW19ySLWUK9dr18Sil25sCJD:6b6XWza9SyLMnfW1X0+nCJ
TLSH
T1D8459F81F2D38AABD261B1B4E92A632BFD74F415173441EF33800921DFB69D0AE75B25
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\gello\Downloads\eris\eris\x64\Release\eris.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

Process32FirstW CloseHandle GetProcAddress GetCurrentProcessId GetModuleHandleW lstrcmpiW SetConsoleTitleW LoadLibraryA QueryPerformanceFrequency MultiByteToWideChar FreeLibrary Process32NextW GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetCurrentThreadId CreateToolhelp32Snapshot GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileA Sleep QueryPerformanceCounter SetConsoleWindowInfo SetCurrentConsoleFontEx GetStdHandle SetConsoleScreenBufferSize InitializeSListHead

user32

PostMessageW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetDC ScreenToClient ClientToScreen GetForegroundWindow LoadCursorW SetCursor GetClientRect DestroyWindow GetAsyncKeyState EnumWindows TranslateMessage GetClassNameW PeekMessageA GetWindowTextW DispatchMessageA SetCursorPos ReleaseDC GetCursorPos

gdi32

GetPixel

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ _Cnd_signal _Thrd_hardware_concurrency _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock _Cnd_broadcast

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate strstr memchr memcmp memcpy memmove memset __C_specific_handler __std_exception_destroy __current_exception_context _CxxThrowException __current_exception

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _beginthreadex

api-ms-win-crt-string-l1-1-0

strcpy_s wcscpy_s strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen _set_fmode fwrite __stdio_common_vfprintf fseek fclose __acrt_iob_func ftell fflush

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

atanf ceilf sin atan2f tanf log sinf acosf asin cos logf roundf cosf pow expf floorf sqrtf tan powf atan2 __setusermatherr fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

483KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eris.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

msvcp140

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic