hydrogen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
hydrogen.exe
Size 128KB
Sample260808-thrn3shq5z
SHA256 283f195bad35cac6e9452c2791eaeb90d9cd6d506aa16c6505247e5be74aabf0
MD5 efdd98ae7ba8aa1a457d6938d554e5bb
SHA1 5adc3d12792396b569bf024676636262bcd9c7ff
SHA512 6c1e6adfcf7416c153b8f57149d232bd3caecda0806369cb00131e0877559953041017a641f910e7360ddeb059e568c4c4bbbbed28ed902f80221a68f1bafae9
SSDEEP 3072:la0U9iSEZV1E2gK90lzIvJx1h9xgfHVpSIzM8ya9icI:lasSEZPEgGOFh9xgKIo
TLSH
T15ED36C27B3A534E8E9B68235C5511606E77378720B209FAF036046B95F376D0AE7BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hydrogen.exe

File Explorer

hydrogen.exe

.exe 128KB

hydrogen.exe

IMPHASH 852865b18a60ae32a1566570a0610b5d
SHA256 283f195bad35cac6e9452c2791eaeb90d9cd6d506aa16c6505247e5be74aabf0
MD5 efdd98ae7ba8aa1a457d6938d554e5bb
SHA1 5adc3d12792396b569bf024676636262bcd9c7ff
SHA512 6c1e6adfcf7416c153b8f57149d232bd3caecda0806369cb00131e0877559953041017a641f910e7360ddeb059e568c4c4bbbbed28ed902f80221a68f1bafae9
SSDEEP 3072:la0U9iSEZV1E2gK90lzIvJx1h9xgfHVpSIzM8ya9icI:lasSEZPEgGOFh9xgKIo
TLSH
T15ED36C27B3A534E8E9B68235C5511606E77378720B209FAF036046B95F376D0AE7BB70
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Cpp\hydrogen\x64\Release\hydrogen.pdb

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize LCMapStringW WriteConsoleW GetProcessHeap HeapAlloc HeapFree GetSystemDirectoryW lstrcmpW lstrcpyW FreeLibrary GetModuleHandleW ExitProcess LocalFree GetProcAddress CreateThread LoadLibraryW CloseHandle DeleteFileW lstrcatW Sleep GetLastError CreateFileW LocalAlloc FindClose SetFilePointer RemoveDirectoryW WriteFile GetCurrentProcess FindNextFileW HeapReAlloc FindFirstFileW GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetModuleFileNameW GetModuleHandleExW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar

user32

RedrawWindow ExitWindowsEx ReleaseDC MessageBoxW EnumChildWindows EnumDisplayMonitors UnionRect DispatchMessageW SetTimer PeekMessageW TranslateMessage GetWindowRect SendMessageTimeoutW GetDC

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC PatBlt SetGraphicsMode StretchBlt PlgBlt CreatePatternBrush DeleteDC TextOutW SetTextColor SetBkColor Ellipse DeleteObject CreateSolidBrush SetWorldTransform

advapi32

CryptAcquireContextW CryptGenRandom LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW OpenProcessToken FreeSid

shell32

SHFileOperationW ShellExecuteW

winmm

waveOutReset waveOutUnprepareHeader waveOutWrite waveOutOpen waveOutPrepareHeader

msimg32

AlphaBlend

Name

.text

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

hydrogen.exe

kernel32

user32

gdi32

advapi32

shell32

winmm

msimg32

generic