Paradise(3)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Paradise(3).exe
Size 5.6MB
Sample260802-ftt2pade48
SHA256 48370428e89bcd15f766cb17f30927a3d88b78f325391698a40d91ae1b0316a4
MD5 a6e25ff73bb7be8fea2bf0d199387120
SHA1 4cd8f781bedf6bfd4aab80e883fc0f2926d047a9
SHA512 c38a1d72e120f9b9fe9cb9dceed636b1a3cf1352315c736a65a17bfb03b7bc313ed73fe2273dca2675e6825b51c44bff245c40700a092ebe3d1c815c6fcbe6da
SSDEEP 49152:X4gjYEzThD0XFAyLqX6u5wbzGXDD+7KqBvddBSWh6y57v1T7/hnT1thsn2HWkECb:oEVgFAnXs7dUnydf6nOEEWKzUAd
TLSH
T103565B1696AE52A8F176E034A8526227F7F17C4D4334CFD75BD00EB70B676D0AABA304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Paradise(3).exe

File Explorer

Paradise(3).exe

.exe 5.6MB

Paradise(3).exe

IMPHASH ea03bf8b9d7292afc9b5e874744a31fa
SHA256 48370428e89bcd15f766cb17f30927a3d88b78f325391698a40d91ae1b0316a4
MD5 a6e25ff73bb7be8fea2bf0d199387120
SHA1 4cd8f781bedf6bfd4aab80e883fc0f2926d047a9
SHA512 c38a1d72e120f9b9fe9cb9dceed636b1a3cf1352315c736a65a17bfb03b7bc313ed73fe2273dca2675e6825b51c44bff245c40700a092ebe3d1c815c6fcbe6da
SSDEEP 49152:X4gjYEzThD0XFAyLqX6u5wbzGXDD+7KqBvddBSWh6y57v1T7/hnT1thsn2HWkECb:oEVgFAnXs7dUnydf6nOEEWKzUAd
TLSH
T103565B1696AE52A8F176E034A8526227F7F17C4D4334CFD75BD00EB70B676D0AABA304
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4067576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

GetClipboardData OpenClipboard EmptyClipboard GetKeyboardLayout TrackMouseEvent SetClipboardData GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetMessageExtraInfo PeekMessageA GetForegroundWindow LoadImageW SetWindowLongA UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageA GetDC DispatchMessageA TranslateMessage SetProcessDPIAware MonitorFromWindow LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC CloseClipboard

gdi32

CreateRectRgn GetDeviceCaps DeleteObject

shell32

ShellExecuteA

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileAttributesExW CreateProcessW GetExitCodeProcess SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA WriteFile TerminateProcess ExitProcess GetCurrentProcess FreeLibraryAndExitThread GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW ExitThread SetStdHandle GetModuleHandleExW GetFileType RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA GetStdHandle GetVolumeInformationA OutputDebugStringA SetEvent WaitForSingleObject CreateEventA Sleep CreateThread GetModuleFileNameW SetConsoleTextAttribute SetConsoleTitleA GetEnvironmentVariableA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA CreateFileA GetFileSizeEx ReadFile CloseHandle HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA RtlLookupFunctionEntry CreateFileW HeapSize WriteConsoleW SetEndOfFile RaiseException RtlPcToFileHeader ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimePreciseAsFileTime TryAcquireSRWLockExclusive EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

dwmapi

DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

480KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1002KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Paradise(3).exe

d3dx11_43

d3d11

d3dcompiler_47

user32

gdi32

shell32

winhttp

kernel32

imm32

dwmapi

generic