admiral[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
admiral.exe
Size 1.5MB
Sample260816-eqcskabb49
SHA256 bb5c7c12d30a5a4eb117e2493af5838140f1ee6769bd245f14440f43557096b5
MD5 0aeb8835e705b24a72fd57a86801e29a
SHA1 ef3cfe792e198c5133005c133e2ba00d4b4681dd
SHA512 1a2775b575f12b83119d7a90713b49a36dfa52553cd6d7574e18e1b94055d2912b777cc585cf776baaa0cdddd5e68f7f55e5254753c1b549de63933da3e66d08
SSDEEP 24576:XjUN6atvu7tIBcE4VFbHhEu1MumFy8Ufm7p6tTnv7t:XwSBdtFbHjqyznDt
TLSH
T17975BF03F355869DC8261C348AE1EBC3B375BC501B25D2CB72993A999F971F00ABB6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
admiral.exe

File Explorer

admiral.exe

.exe 1.5MB

admiral.exe

IMPHASH edbc602a07bab2f36ce922bff7534963
SHA256 bb5c7c12d30a5a4eb117e2493af5838140f1ee6769bd245f14440f43557096b5
MD5 0aeb8835e705b24a72fd57a86801e29a
SHA1 ef3cfe792e198c5133005c133e2ba00d4b4681dd
SHA512 1a2775b575f12b83119d7a90713b49a36dfa52553cd6d7574e18e1b94055d2912b777cc585cf776baaa0cdddd5e68f7f55e5254753c1b549de63933da3e66d08
SSDEEP 24576:XjUN6atvu7tIBcE4VFbHhEu1MumFy8Ufm7p6tTnv7t:XwSBdtFbHjqyznDt
TLSH
T17975BF03F355869DC8261C348AE1EBC3B375BC501B25D2CB72993A999F971F00ABB6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

370608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThreadId GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA GetProcessId Module32First Module32Next SetEndOfFile HeapSize CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP FlushFileBuffers HeapReAlloc SetFilePointerEx ReadConsoleW GetConsoleMode LCMapStringW OpenMutexA VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread MultiByteToWideChar GetLastError Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte ReadProcessMemory OpenProcess CloseHandle ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW Sleep SetUnhandledExceptionFilter WriteConsoleW WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime

user32

SetLayeredWindowAttributes GetSystemMetrics SetForegroundWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage MessageBoxA ReleaseCapture SetCapture GetDC ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode ReleaseDC GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard CreateIconIndirect DestroyIcon LoadCursorW SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetClientRect SetWindowRgn PostMessageW

shell32

ShellExecuteA

gdi32

SwapBuffers CreateBitmap CreateRoundRectRgn DeleteObject SetPixelFormat ChoosePixelFormat CreateDIBSection

opengl32

glClearColor wglCreateContext wglDeleteContext wglMakeCurrent glBindTexture glClear glViewport glDeleteTextures glGenTextures glPixelStorei glTexImage2D glTexParameteri

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

ntdll

NtQueryInformationProcess

dwmapi

DwmSetWindowAttribute

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

Name

.text

Size

512KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1004KB

Virtual Size

1004KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

admiral.exe

kernel32

user32

shell32

gdi32

opengl32

winhttp

ntdll

dwmapi

imm32

generic