SpiritX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SpiritX.exe
Size 234KB
Sample260730-rwvlsazdkd
SHA256 429474cc97f8e6f8c9a61633f7fc2abf3dfc058fc9090a5ae46c2818ee94c853
MD5 0b9ebf62d67351df113f84774a257bd1
SHA1 bef65057152d27df58078f6e3d2ef1a4123f8537
SHA512 5b24a238afc40f650b99706ba0162540ff1c0bd73e9b5177c8b1c3488ecf086a2181740e8400262543be35aeeba7d603f835234010b26d024b726d805b3db2ed
SSDEEP 6144:c+32zbWIPV1pRAa6sqUMM/M1Gv13nUUxvOxQq:132zbHV14ap1P137mxQq
TLSH
T1F8341A5B73931CFCC61BC03986E7B7726472B8140325FE6F5694CB332E62E541AA5E28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SpiritX.exe

File Explorer

SpiritX.exe

.exe 234KB

SpiritX.exe

IMPHASH 8c73906c901a79c10a954bf0b952a309
SHA256 429474cc97f8e6f8c9a61633f7fc2abf3dfc058fc9090a5ae46c2818ee94c853
MD5 0b9ebf62d67351df113f84774a257bd1
SHA1 bef65057152d27df58078f6e3d2ef1a4123f8537
SHA512 5b24a238afc40f650b99706ba0162540ff1c0bd73e9b5177c8b1c3488ecf086a2181740e8400262543be35aeeba7d603f835234010b26d024b726d805b3db2ed
SSDEEP 6144:c+32zbWIPV1pRAa6sqUMM/M1Gv13nUUxvOxQq:132zbHV14ap1P137mxQq
TLSH
T1F8341A5B73931CFCC61BC03986E7B7726472B8140325FE6F5694CB332E62E541AA5E28
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

gdi32

CreateFontA CreateRoundRectRgn CreateSolidBrush DeleteObject SetBkColor SetTextColor

kernel32

CloseHandle CreateEventA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetVolumeInformationA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LocalFree Module32FirstW Module32NextW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _read _setmode fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup isalnum memset strcmp strlen strncmp strnlen tolower wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand_s

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnableWindow FillRect FindWindowExA GetClientRect GetMessageA GetSystemMetrics GetWindowTextA InvalidateRect LoadCursorA PostQuitMessage RegisterClassA SendMessageA SetLayeredWindowAttributes SetWindowPos SetWindowRgn SetWindowTextA ShowWindow TranslateMessage UpdateWindow

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile

Name

.text

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SpiritX.exe

dwmapi

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

wininet

generic