AstralixFinder-Setup-5[.]00[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AstralixFinder-Setup-5.00.exe
Size 6.7MB
Sample260901-2gebcsydld
SHA256 f628408826c50c6832bc449c3e9ee28371047d45cc6d575b765b46d946f35c7c
MD5 b09d0f10eef19f60c01dbf8aad3de930
SHA1 147abc212ffbba3c253086b5046c42065263fdb3
SHA512 3462054de2777e0eb6b0f20b8bd753850a93e8f638c2f7dd95ab6664fe29af6434e3beef4fc26dc3dba1e1989578ba0e46478ae68319ce69d97bdcca442997ae
SSDEEP 98304:vOqxPRy5yQPjc3mAGUc6OwXKBhBH9yLWPq4/h4keKEWU6DaHeQdWIQWXoa2WxbR7:ns7jc3NXsIyhe7UaHe8nL2uSPE
TLSH
T18E663353AE5964FCD567C130A1510662197AF8AA3B31ABFB01F992307F33EE56F38610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AstralixFinder-Setup-5.00.exe

File Explorer

AstralixFinder-Setup-5.00.exe

.exe 6.7MB

AstralixFinder-Setup-5.00.exe

IMPHASH 413a610dd09d9d78c36d442359d241f8
SHA256 f628408826c50c6832bc449c3e9ee28371047d45cc6d575b765b46d946f35c7c
MD5 b09d0f10eef19f60c01dbf8aad3de930
SHA1 147abc212ffbba3c253086b5046c42065263fdb3
SHA512 3462054de2777e0eb6b0f20b8bd753850a93e8f638c2f7dd95ab6664fe29af6434e3beef4fc26dc3dba1e1989578ba0e46478ae68319ce69d97bdcca442997ae
SSDEEP 98304:vOqxPRy5yQPjc3mAGUc6OwXKBhBH9yLWPq4/h4keKEWU6DaHeQdWIQWXoa2WxbR7:ns7jc3NXsIyhe7UaHe8nL2uSPE
TLSH
T18E663353AE5964FCD567C130A1510662197AF8AA3B31ABFB01F992307F33EE56F38610
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ANTI_VM_loader.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

CloseHandle SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep QueryPerformanceFrequency GetLastError CompareStringW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateThread LoadLibraryExW GetTempPathW DeleteFileW LoadLibraryExA FreeLibrary VirtualProtect GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

ole32

CoUninitialize CoInitializeEx CoTaskMemFree

mfplat

MFShutdown MFTEnumEx MFStartup MFCreateAttributes MFCreateMediaType

mfreadwrite

MFCreateSinkWriterFromURL

ntdll

NtOpenFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile

oleaut32

GetErrorInfo SysStringLen SysFreeString

Name

.text

Size

216KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AstralixFinder-Setup-5.00.exe

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

kernel32

ole32

mfplat

mfreadwrite

ntdll

oleaut32

generic