Hellion[.]exe | Triage™

General

Target
Hellion.exe
Size 38.2MB
Sample260902-2exd6afk4v
SHA256 3070f046294bd3e358d00022f20434a3f03ca17fcf3466d4243c36f4af940a02
MD5 83a8afdf31aeab3345d33e250d67031f
SHA1 8764f19dc5ff8aff6e81d8981de131c7fa8babbf
SHA512 a9f6683b93f09422700f0142b03562d8835f8ee8ad770e5b50b57c1cf777476c6385a538e2dd5b419c27d810376e80560f620732d6e53fea44705a9fb843ef1f
SSDEEP 786432:EUdugg9So1LCW+5KFHh6mwsBGYi1rBjPIj+xRgdAxQ0cVojz4WQ5h:EbhS0VB6sPi1rpIboj
TLSH
T14797333637689E78FDBEE2BC0DBA6101963BD0942370C69F671655F49A3BB558F02380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Hellion.exe

File Explorer

Hellion.exe

.exe 38.2MB

Hellion.exe

IMPHASH 259c038cd4434231e0e24f278026a0ea
SHA256 3070f046294bd3e358d00022f20434a3f03ca17fcf3466d4243c36f4af940a02
MD5 83a8afdf31aeab3345d33e250d67031f
SHA1 8764f19dc5ff8aff6e81d8981de131c7fa8babbf
SHA512 a9f6683b93f09422700f0142b03562d8835f8ee8ad770e5b50b57c1cf777476c6385a538e2dd5b419c27d810376e80560f620732d6e53fea44705a9fb843ef1f
SSDEEP 786432:EUdugg9So1LCW+5KFHh6mwsBGYi1rBjPIj+xRgdAxQ0cVojz4WQ5h:EbhS0VB6sPi1rpIboj
TLSH
T14797333637689E78FDBEE2BC0DBA6101963BD0942370C69F671655F49A3BB558F02380
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

SetLastError WriteConsoleW HeapReAlloc CreateDirectoryW SizeofResource SetConsoleCtrlHandler GetCommandLineW GetStdHandle WriteFile TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc MultiByteToWideChar HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Sharing