EAX Console[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EAX Console.exe
Size 102KB
Sample260809-cpp1dsycpe
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EAX Console.exe

File Explorer

EAX Console.exe

.exe 102KB

EAX Console.exe

IMPHASH 9ed60560d25b1a44a275d280bff5e815
SHA256 7b5099a2989a1e7d52ac7a1c653b5dfb22f2c33ca01a00d20cd48276fc992f76
MD5 4ff8e9553cd105851a7b58ac3729a5e8
SHA1 b171ff8f4913366891c3222afadb34e040392a68
SHA512 8d0eafeb32230bedbe160116e4196cbe2c8d652cea15bfe2820af06390065f544927b7c0a9721ccf259e8c35b116d40aea12a78d0c5ee9668253b16b1c4fa112
SSDEEP 1536:kYvxrhs3z5F8JPDCkRNLT8vJDxXjmJe37AG8Du6+WSss/eYwp:kAxNssh9RhiJIE3UY6+WSvm
TLSH
T1BDA33A06F75354E8C51EF1F445E6E673AA32BC1540309B6A16F0FA323E70A53EE69A1C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext FreeSid GetUserNameA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CopyFileA CreateFileA CreateMutexA CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsA FreeLibrary GetComputerNameA GetCurrentDirectoryW GetCurrentProcessId GetDiskFreeSpaceExA GetFileAttributesA GetFileAttributesExA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetSystemInfo GetTickCount GetTickCount64 GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess PeekNamedPipe ReadFile SetFileAttributesA SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _strdup _stricmp abort calloc exit fprintf fputc free fwrite localeconv malloc memcpy realloc signal strerror strlen strncmp strncpy strrchr strstr vfprintf wcslen

ws2_32

WSAIoctl WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send setsockopt socket

Name

.text

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

38KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

EAX Console.exe

advapi32

bcrypt

kernel32

msvcrt

ws2_32

generic