Aurora[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Aurora.exe
Size 155KB
Sample260912-wsfexasare
SHA256 3a54eee619f4f4b3ffb476b5e77a06ee7c32ef9c0ccc7406dcac5e724b34c8af
MD5 e0689b7c6ad5f546e21230b1bf31a113
SHA1 53860dde1ac70df87457981964360d5255fc901f
SHA512 5e159a595da7fec015cd05ad7bf1efeca2b0e40b312afddd473d101826c35449fbe1a8a09b9fdda02f5c88c53246d86b3b93cd653f30a1997d3194c807ec6ab0
SSDEEP 3072:s8KZQHjWatUHkh5i7/zOE714qebJ2J1nn/uy:JKQDWSh55e1/
TLSH
T164F32A5BB3A530F9E0B7C279C9920606F772B87157609B9F07A0427A1F272D0DD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aurora.exe

File Explorer

Aurora.exe

.exe 155KB

Aurora.exe

IMPHASH 2bcb8ed485f43ff1d162d0106b0646bf
SHA256 3a54eee619f4f4b3ffb476b5e77a06ee7c32ef9c0ccc7406dcac5e724b34c8af
MD5 e0689b7c6ad5f546e21230b1bf31a113
SHA1 53860dde1ac70df87457981964360d5255fc901f
SHA512 5e159a595da7fec015cd05ad7bf1efeca2b0e40b312afddd473d101826c35449fbe1a8a09b9fdda02f5c88c53246d86b3b93cd653f30a1997d3194c807ec6ab0
SSDEEP 3072:s8KZQHjWatUHkh5i7/zOE714qebJ2J1nn/uy:JKQDWSh55e1/
TLSH
T164F32A5BB3A530F9E0B7C279C9920606F772B87157609B9F07A0427A1F272D0DD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FlushFileBuffers GetFileAttributesW GetFileInformationByHandle GetFileSizeEx ReadFile SetFilePointerEx WriteFile CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW DeleteFileW GetTickCount64 MoveFileExW GetCommandLineW LocalFree MultiByteToWideChar WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle CreateFileW CreateProcessW CreateDirectoryW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW

user32

SendMessageW

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx ord345

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpReadData WinHttpConnect WinHttpCloseHandle

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Aurora.exe

kernel32

user32

shell32

ole32

comctl32

winhttp

bcrypt

generic