Prestige-Client (3)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Prestige-Client (3).exe
Size 749KB
Sample260809-mcec8sdm8v
SHA256 4507816e4942a66caa4986c5e732386aea8679f9b5253a5e17959416825e6b08
MD5 d101c0eeb89ce736928a061f100337de
SHA1 feb0a5a4280eef41b7fa96be26e4698eb30804a2
SHA512 7fefc0edd645617c8062f4d1bc263c44d7f57d11c869f776cf54384eb735c1adf8db6ffa29a56cd8d436db3662cd3273d9e2f16de8fddf319e09a048fce3cda9
SSDEEP 12288:LghUjKHgMt5PsrSuf+v+4o0+W6YLqjlOHnfR7oBmTzipavj/FYi8l5FUnI:vjKHgkKWv+4o0j6YLqjlOHnfR7okTz48
TLSH
T1CFF48C6AABF801F9D0BBC138C5475617E7B2B415236097DB02A48AB92F236E51F3F351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Prestige-Client (3).exe

File Explorer

Prestige-Client (3).exe

.exe 749KB

Prestige-Client (3).exe

IMPHASH c48ec9fabbe14329942c8cc66b3ae7bd
SHA256 4507816e4942a66caa4986c5e732386aea8679f9b5253a5e17959416825e6b08
MD5 d101c0eeb89ce736928a061f100337de
SHA1 feb0a5a4280eef41b7fa96be26e4698eb30804a2
SHA512 7fefc0edd645617c8062f4d1bc263c44d7f57d11c869f776cf54384eb735c1adf8db6ffa29a56cd8d436db3662cd3273d9e2f16de8fddf319e09a048fce3cda9
SSDEEP 12288:LghUjKHgMt5PsrSuf+v+4o0+W6YLqjlOHnfR7oBmTzipavj/FYi8l5FUnI:vjKHgkKWv+4o0j6YLqjlOHnfR7okTz48
TLSH
T1CFF48C6AABF801F9D0BBC138C5475617E7B2B415236097DB02A48AB92F236E51F3F351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

417536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recvfrom send WSACloseEvent gethostname ioctlsocket sendto getsockopt freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

wldap32

ord217 ord35 ord46 ord301 ord200 ord30 ord79 ord143 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

normaliz

IdnToUnicode IdnToAscii

kernel32

LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode WriteFile GetModuleFileNameW SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle ExitProcess VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc RtlAddFunctionTable LoadLibraryA GetProcAddress FlushInstructionCache ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetTickCount CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA MultiByteToWideChar QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA FreeLibrary GetModuleHandleA SleepEx Sleep WideCharToMultiByte GetLastError SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA RtlUnwind GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx GetDriveTypeW CreateFileW LoadLibraryExW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW DeleteFileW GetTimeZoneInformation HeapSize WriteConsoleW GetStdHandle TlsFree TlsSetValue RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

user32

MessageBoxW

advapi32

CryptHashData CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash OpenThreadToken CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

bcrypt

BCryptGenRandom

Name

.text

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Prestige-Client (3).exe

ws2_32

wldap32

crypt32

normaliz

kernel32

user32

advapi32

bcrypt

generic