atom[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
atom.exe
Size 978KB
Sample260814-dfd27stbnb
SHA256 51bcbd26b303e340679e3b837780210ecc25fc844427ac93cb905fc21061dc4f
MD5 55696f3c77b40f299db5b6b11200c910
SHA1 d9ec37a36baa76b71f79409b01efa0dd3fd43df2
SHA512 87cc2bb53d3488c157d03972f3352f089ef1a8b61634f481323764e15bc1d240db14e5602345194f70c143725bac2f25616bd25cbc1636d833c5af57c8512fa8
SSDEEP 24576:OlY9HsymIbmJO6eSzKnlV6cbsRG6ELOGf3:O+MyyGSGlVFDh3v
TLSH
T15625D125BAF2C032C32382318D6CF7A911EEBDB04D76425773E82B5D6E70591AB26537
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atom.exe

File Explorer

atom.exe

.exe 978KB

atom.exe

IMPHASH fae329008be81e5f871f33a411b21b1a
SHA256 51bcbd26b303e340679e3b837780210ecc25fc844427ac93cb905fc21061dc4f
MD5 55696f3c77b40f299db5b6b11200c910
SHA1 d9ec37a36baa76b71f79409b01efa0dd3fd43df2
SHA512 87cc2bb53d3488c157d03972f3352f089ef1a8b61634f481323764e15bc1d240db14e5602345194f70c143725bac2f25616bd25cbc1636d833c5af57c8512fa8
SSDEEP 24576:OlY9HsymIbmJO6eSzKnlV6cbsRG6ELOGf3:O+MyyGSGlVFDh3v
TLSH
T15625D125BAF2C032C32382318D6CF7A911EEBDB04D76425773E82B5D6E70591AB26537
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

136988

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Build\JenkinsHome\jobs\desktop_apps_ng\workspace\build\loader\Release\loader.pdb

kernel32

LoadLibraryW FreeLibrary CreateDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetStartupInfoW CreateProcessW GetACP SetLastError HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap InterlockedCompareExchange MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetVersionExW GetNativeSystemInfo InitializeCriticalSection InterlockedDecrement GlobalAlloc GlobalLock InterlockedIncrement GlobalUnlock lstrcmpW MulDiv ReadFile SetFilePointer GetFileSize CreateTimerQueue UnregisterWaitEx QueryDepthSList ReleaseSemaphore DuplicateHandle CopyFileW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread WriteFile SetEndOfFile WriteConsoleW SetStdHandle CreateThread FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP FlushFileBuffers GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCurrentThread GetStdHandle DeleteFileW GetDiskFreeSpaceExW SetEvent GetCurrentThreadId LeaveCriticalSection GetModuleFileNameW RemoveDirectoryW EnterCriticalSection GetSystemTimeAsFileTime GetModuleHandleA CreateFileW GetModuleHandleExW ExitProcess LoadLibraryExW InterlockedFlushSList RtlUnwind VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList OutputDebugStringW GetCPInfo GetLocaleInfoW LCMapStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep GetStringTypeW TryEnterCriticalSection InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent GetModuleHandleW GetProcAddress CreateEventW LocalFree GetCommandLineW GetExitCodeProcess DeleteCriticalSection DecodePointer RaiseException CloseHandle GetLastError SignalObjectAndWait InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA

user32

PostThreadMessageW SendMessageW wsprintfW GetCursorPos UnregisterClassW DefWindowProcW LoadCursorW RegisterClassExW PeekMessageW TranslateMessage DispatchMessageW SetWindowLongW DestroyWindow SetTimer InvalidateRgn KillTimer GetWindowTextLengthW GetWindow GetFocus GetDC SetWindowPos FillRect ScreenToClient GetSystemMetrics SetWindowTextW ShowWindow IsWindow MsgWaitForMultipleObjects RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild GetSysColor MoveWindow CreateAcceleratorTableW SetFocus CharNextW GetClassNameW SetCapture GetClientRect GetDlgItem GetDesktopWindow SystemParametersInfoW GetParent RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW CallWindowProcW CreateWindowExW GetClassInfoExW PostQuitMessage GetWindowLongW

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC GetObjectW DeleteObject CreateSolidBrush

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

StringFromCLSID CoCreateGuid CoTaskMemFree CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance OleInitialize CoGetClassObject CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CreateStreamOnHGlobal CLSIDFromString OleLockRunning OleUninitialize

oleaut32

SysAllocString LoadTypeLi SysFreeString VariantClear SysStringLen VariantInit OleCreateFontIndirect DispCallFunc SysAllocStringLen LoadRegTypeLi VariantCopy

advapi32

CryptDestroyKey CryptAcquireContextW CryptVerifySignatureW CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext RegSetValueExW RegNotifyChangeKeyValue RegCreateKeyExW RegQueryValueExW RegCloseKey

shlwapi

StrToIntExW PathFindFileNameW

ws2_32

ntohl