PermV1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PermV1.exe
Size 11.7MB
Sample260916-yz29csdf58
SHA256 04c026655355033b022a1ecc681b26eeab1a1ee82d1a245c18c3b7fa4d5a1ccf
MD5 e924f7b58c8de13ea649a71427387bca
SHA1 4aa86b93fce436e4cb5e1cd9a36cc21b80ce5034
SHA512 848644f2ca892352a7abee0f25a5cf8be2bfad049eab53c90f87bc8eb587671611dff0c4ff0fa2165a8a72648bfc3321d6bc9d8332fb8e3c8d574935e523e62b
SSDEEP 196608:8mM6NAzLbr0SXuzTAhV0I3UMhD0hpM42rpVAmLaguBsKLRL:W6NAzLbr0SXqu+I3qWpVAmFu2K
TLSH
T175C68D16BBAA49D5D0B3923489669667F3B2BC500BB4C7CF3298560E1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PermV1.exe

File Explorer

PermV1.exe

.exe 11.7MB

PermV1.exe

IMPHASH 0cf4576cf189f90d83c1a3e850de8139
SHA256 04c026655355033b022a1ecc681b26eeab1a1ee82d1a245c18c3b7fa4d5a1ccf
MD5 e924f7b58c8de13ea649a71427387bca
SHA1 4aa86b93fce436e4cb5e1cd9a36cc21b80ce5034
SHA512 848644f2ca892352a7abee0f25a5cf8be2bfad049eab53c90f87bc8eb587671611dff0c4ff0fa2165a8a72648bfc3321d6bc9d8332fb8e3c8d574935e523e62b
SSDEEP 196608:8mM6NAzLbr0SXuzTAhV0I3UMhD0hpM42rpVAmLaguBsKLRL:W6NAzLbr0SXqu+I3qWpVAmFu2K
TLSH
T175C68D16BBAA49D5D0B3923489669667F3B2BC500BB4C7CF3298560E1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

885980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

libsodium

sodium_hex2bin crypto_sign_ed25519_verify_detached sodium_init

kernel32

MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW GetFileSizeEx SetFileInformationByHandle GetFileAttributesExW LoadLibraryW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW FormatMessageA GetLocaleInfoEx SleepConditionVariableSRW GetCurrentThreadId IsDebuggerPresent OutputDebugStringW SleepEx GetSystemDirectoryW GetProcAddress LeaveCriticalSection EnterCriticalSection FormatMessageW SetLastError AcquireSRWLockExclusive ReleaseSRWLockExclusive GetTickCount CreateDirectoryA GetConsoleWindow DeleteFileA GlobalUnlock GlobalLock GlobalFree GlobalAlloc LoadLibraryA MultiByteToWideChar QueryPerformanceCounter FreeLibrary VerSetConditionMask QueryPerformanceFrequency WideCharToMultiByte LocalFree MapViewOfFile CreateFileMappingW QueryFullProcessImageNameW GetModuleHandleW GetProcessHeap DeleteCriticalSection HeapDestroy AddVectoredExceptionHandler HeapAlloc CreateThread CloseHandle HeapReAlloc GetLastError Sleep HeapSize GetModuleHandleA UnmapViewOfFile CreateFileW InitializeCriticalSectionEx GetModuleFileNameW GetCurrentProcess HeapFree VirtualProtect GetModuleFileNameA SetUnhandledExceptionFilter WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead CreateFile2 AreFileApisANSI GetFileInformationByHandleEx

user32

GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient UnregisterClassW GetKeyState SetClipboardData OpenClipboard GetClipboardData EmptyClipboard CloseClipboard UpdateWindow SystemParametersInfoW PostQuitMessage LoadIconW TranslateMessage SetLayeredWindowAttributes MoveWindow PeekMessageW MessageBoxA DefWindowProcW SetWindowLongA DispatchMessageW ShowWindow GetWindowLongW GetWindowRect DestroyWindow MessageBoxW CreateWindowExW GetSystemMetrics RegisterClassExW

advapi32

CryptCreateHash AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid GetUserNameA RegCreateKeyExA RegDeleteKeyA ConvertSidToStringSidW CopySid CheckTokenMembership FreeSid CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData GetTokenInformation CryptGetHashParam CryptReleaseContext CryptAcquireContextW AllocateAndInitializeSid

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitialize

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ??Bios_base@std@@QEBA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFindExtension CertGetCertificateChain CertFreeCertificateChain CertOpenStore

ws2_32

select accept htonl listen getaddrinfo WSAIoctl recvfrom WSAEnumNetworkEvents sendto ioctlsocket gethostname __WSAFDIsSet freeaddrinfo getsockopt send connect WSACloseEvent WSACreateEvent getpeername WSACleanup getsockname WSAEventSelect socket WSAResetEvent bind WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton htons recv ntohs WSASetLastError inet_ntop setsockopt WSAStartup

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr __current_exception_context _CxxThrowException memchr memcmp memmove strrchr strchr memset memcpy strstr __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-runtime-l1-1-0

terminate __sys_nerr exit __sys_errlist _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _resetstkoflw _c_exit _errno __p___argv _exit _initterm_e _beginthreadex abort _initterm _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argc _get_initial_narrow_environment system

api-ms-win-crt-stdio-l1-1-0

_lseeki64 _set_fmode __stdio_common_vsscanf fflush _get_stream_buffer_pointers _wopen fputc fclose __p__commode ftell _read _write fsetpos feof _fileno _close fread _pclose fputs __acrt_iob_func ungetc _popen setvbuf fgetpos fseek __stdio_common_vsprintf __stdio_common_vfprintf fwrite __stdio_common_vsprintf_s fgets _wfopen _fseeki64 fgetc

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc free _set_new_mode calloc _recalloc

api-ms-win-crt-math-l1-1-0

powf _dsign sinf cosf sqrtf _dclass __setusermatherr ceilf acosf _fdopen

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod wcstombs strtoul atoi strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlink _unlock_file _wstat64 remove _fstat64

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 _localtime64 strftime

api-ms-win-crt-string-l1-1-0

tolower _strdup wcsncpy strpbrk wcsncmp strcmp strspn wcslen wcspbrk strncmp strcspn _wcsdup islower isalnum isupper strlen isdigit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand qsort