anomixboss[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
anomixboss.exe
Size 3.8MB
Sample260806-xd7raayblh
SHA256 5f1bd158b627d6d37d4b57bc0d968bab52a8041bb18ba495c42fc9f3eb3ddebd
MD5 4e60dae7419d53473aac28d2ca5b02c3
SHA1 3d8af4bbfc4a521e54b29ba61fc4a69b4ddcd974
SHA512 7fe2d61170db14761ac7e92f954b84c409d8d0a1964a2fb762d8b97ade6229c6c192e01d70b2e67dfd679e09e62233c2d7f9b21ad35754b7bcd7a6b62e734760
SSDEEP 49152:GTsqLURabREp4y3VkT8+HE3uxuMvx6KrTZrNyA+2dWhT8p5Q/HVwy:GRLFijVMxdYGTZ3bI
TLSH
T15806DF0AF1978268DF726B3888A16263C1B0BCC547B0C2E75A9F8B759F675F04A7D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
anomixboss.exe

File Explorer

anomixboss.exe

.exe 3.8MB

anomixboss.exe

IMPHASH eb6ef4b51c627431a76ac9cc5e0dbd00
SHA256 5f1bd158b627d6d37d4b57bc0d968bab52a8041bb18ba495c42fc9f3eb3ddebd
MD5 4e60dae7419d53473aac28d2ca5b02c3
SHA1 3d8af4bbfc4a521e54b29ba61fc4a69b4ddcd974
SHA512 7fe2d61170db14761ac7e92f954b84c409d8d0a1964a2fb762d8b97ade6229c6c192e01d70b2e67dfd679e09e62233c2d7f9b21ad35754b7bcd7a6b62e734760
SSDEEP 49152:GTsqLURabREp4y3VkT8+HE3uxuMvx6KrTZrNyA+2dWhT8p5Q/HVwy:GRLFijVMxdYGTZ3bI
TLSH
T15806DF0AF1978268DF726B3888A16263C1B0BCC547B0C2E75A9F8B759F675F04A7D701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

761100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileA

wininet

InternetOpenA InternetCloseHandle InternetConnectA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetOpenUrlA

kernel32

IsDebuggerPresent CheckRemoteDebuggerPresent TerminateProcess SetFileTime GetModuleFileNameW WaitForSingleObject CreateFileW SetFileInformationByHandle CreateFileA GetLocalTime SystemTimeToFileTime GetSystemTime UnmapViewOfFile GetLastError SetEvent CreateFileMappingA GetModuleHandleW CreateEventA MapViewOfFile WriteProcessMemory OpenProcess Module32FirstW VirtualAllocEx Module32NextW GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx VirtualProtect FindNextFileW WriteFile DeviceIoControl RemoveDirectoryW GetEnvironmentVariableW SetEndOfFile GetTempPathW FindClose GetFileAttributesW ExitThread DeleteFileW FreeConsole SetFilePointerEx MoveFileExW GetCurrentProcessId CreateProcessW MoveFileW VirtualQuery FlushFileBuffers GetSystemFirmwareTable HeapFree GetVolumeInformationA GetFileAttributesA AddAtomA HeapAlloc GetAtomNameA FindAtomA GetProcessHeap CreateDirectoryA FormatMessageA GetComputerNameA VirtualFree OutputDebugStringA VirtualAlloc GetCurrentThread GetThreadContext RemoveVectoredExceptionHandler AddVectoredExceptionHandler K32GetModuleInformation GetModuleHandleExW GetModuleHandleA SetHandleInformation CreateMutexA SleepEx TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError CreateProcessA RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LCMapStringEx WakeAllConditionVariable GetSystemTimeAsFileTime LoadLibraryExW InitializeCriticalSectionEx GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx LocalFree GetStringTypeW GetConsoleMode GetCurrentProcess QueryPerformanceCounter FreeLibrary GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CloseHandle Process32FirstW Process32NextW GetTickCount64 CreateToolhelp32Snapshot GetTickCount Sleep VirtualQueryEx ReadProcessMemory VirtualProtectEx GetSystemInfo ExitProcess ReadConsoleW GetConsoleOutputCP IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize HeapReAlloc OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA RtlUnwind IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadFile WriteConsoleW GetFileType GetStdHandle FreeLibraryAndExitThread CreateThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW

user32

GetWindowTextA GetWindowTextLengthA GetWindowLongW SetWindowLongA GetWindowRect GetWindowThreadProcessId GetWindowTextLengthW EnumWindows GetWindowTextW DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW MapWindowPoints MoveWindow SetLayeredWindowAttributes LoadIconW GetParent GetKeyState GetMessageExtraInfo ScreenToClient GetCapture IsWindowVisible TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendInput SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity TranslateMessage SetWindowLongW GetClientRect UpdateWindow SetForegroundWindow ClientToScreen MessageBoxA

comdlg32

GetOpenFileNameA

advapi32

AllocateAndInitializeSid RegEnumValueW CloseServiceHandle OpenSCManagerA ControlService OpenServiceA GetUserNameA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges RegCloseKey SetSecurityDescriptorOwner AddAccessAllowedAce RegEnumKeyExW RegSetKeySecurity RegSetValueExW OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl RegOpenKeyExW RegDeleteValueW GetLengthSid RegQueryValueExW

shell32

SHGetFolderPathA

ole32

CoCreateInstance CoInitialize

winmm

mciSendStringA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

shlwapi

PathFileExistsW

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGetProperty

Name

.text

Size

966KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

anomixboss.exe

d3d11

d3dx11_43

wininet

kernel32

user32

comdlg32

advapi32

shell32

ole32

winmm

imm32

d3dcompiler_43

dwmapi

ntdll

shlwapi

bcrypt

generic