pluto[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pluto.exe
Size 15.7MB
Sample260820-xbebysfc36
SHA256 f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff
MD5 d538861e64c56b5652f5b18a3e253af5
SHA1 ef451e8c0d9c89f85c6664d6449b747b5db3858c
SHA512 672a24d2914932db750d89ee17afc7b7b0030f996278601f5a92ee401e0e9cbbab82634d8d277635ed36f7182097e37505c48e2f6fe8bb75bc5cca988a7d3d08
SSDEEP 196608:WS/U8dfbwwpRvfvWn+T2mYxrxr07BZOlJGJIGj:RdfBRHW+jYxdYBZgJb+
TLSH
T1F6F649217A5A996DC19BC47483874A720E7130CB0B39B9FF449592382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pluto.exe

File Explorer

pluto.exe

.exe 15.7MB

pluto.exe

IMPHASH c0bd0891ba338a0c6886946797ab6290
SHA256 f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff
MD5 d538861e64c56b5652f5b18a3e253af5
SHA1 ef451e8c0d9c89f85c6664d6449b747b5db3858c
SHA512 672a24d2914932db750d89ee17afc7b7b0030f996278601f5a92ee401e0e9cbbab82634d8d277635ed36f7182097e37505c48e2f6fe8bb75bc5cca988a7d3d08
SSDEEP 196608:WS/U8dfbwwpRvfvWn+T2mYxrxr07BZOlJGJIGj:RdfBRHW+jYxdYBZgJb+
TLSH
T1F6F649217A5A996DC19BC47483874A720E7130CB0B39B9FF449592382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8116220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pluto.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW EventSetInformation SystemFunction036 EventWriteTransfer EventUnregister EventRegister

ntdll

NtCancelIoFileEx RtlGetVersion NtDeviceIoControlFile RtlNtStatusToDosError NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCreateFile

kernel32

GetSystemTimeAsFileTime FlsGetValue SleepConditionVariableSRW WakeAllConditionVariable lstrlenW AcquireSRWLockExclusive ReleaseSRWLockExclusive FindNextFileW RtlLookupFunctionEntry LoadLibraryA GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW LoadLibraryW FlsAlloc GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar QueryPerformanceFrequency SleepEx ReadFileEx ExitProcess GetTempPathW SetEnvironmentVariableW FlsSetValue FindClose FindFirstFileExW RtlPcToFileHeader DeleteFileW SwitchToThread GetFileInformationByHandleEx DeviceIoControl CreateDirectoryW MoveFileExW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject DuplicateHandle GetModuleHandleW GetUserDefaultUILanguage SetHandleInformation SetFileCompletionNotificationModes SetFileInformationByHandle GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW FlsFree EncodePointer InitializeSListHead FreeLibrary ReleaseMutex CreateMutexA GetCurrentProcessId SetUnhandledExceptionFilter WaitForSingleObjectEx LCIDToLocaleName GetFullPathNameW WideCharToMultiByte GetCurrentProcess HeapReAlloc GetEnvironmentVariableW RtlVirtualUnwind RtlUnwindEx GetCurrentThreadId RaiseException GetModuleHandleA LoadLibraryExA Sleep HeapAlloc GetProcAddress CloseHandle InitializeCriticalSectionEx FormatMessageW GetFinalPathNameByHandleW RtlCaptureContext CreateFileW SetNamedPipeHandleState GetConsoleMode GetFileInformationByHandle GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult DeleteCriticalSection

user32

GetTouchInputInfo RedrawWindow VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo TrackMouseEvent DestroyMenu DrawIconEx CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW SendMessageW TranslateMessage AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable CreateIcon ToUnicodeEx GetKeyState SystemParametersInfoW GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetMenu GetUpdateRect FillRect SetPropW SetWindowLongW EnableMenuItem DispatchMessageW LoadCursorW PostMessageW GetSystemMenu ClipCursor GetClipCursor ShowCursor MonitorFromRect GetRawInputData ClientToScreen EnumDisplayMonitors MonitorFromPoint GetKeyboardLayout SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow DestroyIcon PeekMessageW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetSystemMetrics CloseTouchInputHandle RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC SetWindowPos GetClientRect IsProcessDPIAware GetDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled GetWindowLongW SetCursor GetCursorPos PostThreadMessageW ScreenToClient ValidateRect GetMonitorInfoW IsWindowVisible RegisterTouchWindow IsWindow AdjustWindowRectEx GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW GetMessageW MapVirtualKeyW TranslateAcceleratorW MonitorFromWindow GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn DestroyWindow IsIconic EnumChildWindows DispatchMessageA GetMessageA CreateWindowExW RegisterClassExW SystemParametersInfoA AdjustWindowRect

shell32

DragFinish SHGetKnownFolderPath ILFree SHAppBarMessage DragQueryFileW SHOpenFolderAndSelectItems ShellExecuteExW ILCreateFromPathW ShellExecuteW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ole32

CoUninitialize CoInitializeEx RevokeDragDrop CoInitialize RegisterDragDrop CoTaskMemAlloc CoCreateInstance OleInitialize CoTaskMemFree CoCreateFreeThreadedMarshaler

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

gdi32

CreateRectRgn SetBkMode DeleteDC SelectObject CreateDIBSection GetDeviceCaps BitBlt CreateCompatibleDC CombineRgn CreateSolidBrush SetTextColor DeleteObject

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo SysStringLen GetErrorInfo SysFreeString

ws2_32

freeaddrinfo WSAStartup WSACleanup getaddrinfo closesocket getpeername getsockopt WSAGetLastError getsockname recv WSASend send setsockopt ioctlsocket connect shutdown bind WSASocketW WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc round roundf pow floor __setusermatherr

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s wcslen _wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _cexit _configure_narrow_argv _c_exit _register_thread_local_exe_atexit_callback __p___argv _initterm abort __p___argc _exit _initterm_e exit terminate _seh_filter_exe _set_app_type _crt_atexit _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc