Element[.]aex | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Element.aex
Size 11.0MB
Sample260920-xlrd9sys4p
SHA256 dbf81c378033b76937e5f3568adc081f8e8f15cf9573f71aa3ad3cc9da12c546
MD5 80e06498e700a42a7562e1e5ae451a48
SHA1 60b4640bd0c9c03b7469eeb0e40081be969da1d4
SHA512 8eafbae3194e41e748551dd5cc47be299dccdaaa672e6e4a20d117161068da2c9736df39344b3e971dde90a26069dfcd98a61e384f39efd9548d814462ed51dd
SSDEEP 98304:vhlez43Rb0B0yxYmCGIHNCVjzzpP/YLJ5slKGuuoiY7ex0d:vWzKiVSNHUVj/tAF5mKvqC
TLSH
T1CDC67B12A7A509E9C8639078C5A7AF07C6B6B8A40B3047E7337E4B1E2F777D0153A761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Element.aex

File Explorer

Element.aex

.dll 11.0MB

Element.aex

IMPHASH 47d4fc9c31949a471fd2c5af59bbd4f1
SHA256 dbf81c378033b76937e5f3568adc081f8e8f15cf9573f71aa3ad3cc9da12c546
MD5 80e06498e700a42a7562e1e5ae451a48
SHA1 60b4640bd0c9c03b7469eeb0e40081be969da1d4
SHA512 8eafbae3194e41e748551dd5cc47be299dccdaaa672e6e4a20d117161068da2c9736df39344b3e971dde90a26069dfcd98a61e384f39efd9548d814462ed51dd
SSDEEP 98304:vhlez43Rb0B0yxYmCGIHNCVjzzpP/YLJ5slKGuuoiY7ex0d:vWzKiVSNHUVj/tAF5mKvqC
TLSH
T1CDC67B12A7A509E9C8639078C5A7AF07C6B6B8A40B3047E7337E4B1E2F777D0153A761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4969564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\VideoCopilot\Repositories\_repo\element 2.2\element\Win\x64\Release\Element.pdb

opengl32

glGetTexLevelParameteriv glGetIntegerv glGetError glTexSubImage2D glDrawArrays glDrawElements glPolygonOffset glClearDepth glColorMask glClear glClearColor glReadBuffer glViewport glTexParameterf glTexParameteri glDepthMask glPointSize glPolygonMode glDisable glFrontFace glCullFace glEnable glDeleteTextures glTexImage2D glBindTexture glGenTextures wglMakeCurrent wglGetCurrentDC glPixelStorei wglCreateContext wglGetProcAddress wglDeleteContext glGetString glGetFloatv glBlendFunc glReadPixels glFinish wglGetCurrentContext

glu32

gluTessCallback gluTessBeginPolygon gluDeleteTess gluTessEndPolygon gluTessEndContour gluNewTess gluTessProperty gluTessBeginContour gluTessVertex

ws2_32

gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl ntohs getsockopt getsockname getpeername WSASetLastError select __WSAFDIsSet WSAGetLastError closesocket WSACleanup socket htons inet_addr connect bind listen setsockopt send recv accept WSAStartup

dwrite

DWriteCreateFactory

d2d1

ord1

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle HeapSize GetFileAttributesW MulDiv HeapReAlloc EnumSystemLocalesW GetWindowsDirectoryW VirtualProtect HeapFree VirtualFree VirtualAlloc LoadLibraryA HeapAlloc GetProcAddress GetProcessHeap FreeLibrary GetModuleHandleExW GetModuleFileNameW GetModuleHandleW MultiByteToWideChar WideCharToMultiByte OutputDebugStringA GetEnvironmentVariableW LoadLibraryW QueryPerformanceFrequency QueryPerformanceCounter CreateFileW SetFilePointerEx SetEndOfFile GetFileSize CreateFileMappingW UnmapViewOfFile GetSystemInfo MapViewOfFile CloseHandle CreateDirectoryW GetCurrentProcess GetTempPathW GetCurrentThreadId GetLocalTime GetCurrentProcessId GetShortPathNameW GetLongPathNameW GlobalMemoryStatusEx GlobalAlloc GlobalLock GlobalUnlock GlobalFree CreateMutexW WaitForSingleObject ReleaseMutex CreateSemaphoreW ReleaseSemaphore GetSystemTimeAsFileTime GetFileAttributesExW Sleep FindFirstFileW FindClose FindNextFileW GetLastError LocalFree ExitProcess SetLastError GetCurrentThread GetTickCount64 EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx FormatMessageA WaitForSingleObjectEx GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA VerSetConditionMask GetEnvironmentStringsW GetModuleHandleA VerifyVersionInfoA IsDebuggerPresent DebugBreak FileTimeToLocalFileTime FileTimeToSystemTime InitializeCriticalSection SetEvent SwitchToThread SetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleWindowInfo FreeConsole SetConsoleTitleA AllocConsole WriteConsoleA ResetEvent CreateEventA CreateThread FindFirstFileA FindNextFileA GetModuleFileNameA GetCommandLineW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileSizeEx FlushFileBuffers GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetFileInformationByHandle ResumeThread ExitThread DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetFullPathNameW GetDriveTypeW RaiseException RtlPcToFileHeader RtlUnwindEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetVersionExW LoadLibraryExW FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer GetTickCount CreateEventW InitializeCriticalSectionAndSpinCount GetStringTypeW GetNativeSystemInfo FreeEnvironmentStringsW WriteConsoleW CreateSemaphoreA TryEnterCriticalSection DuplicateHandle GetSystemDirectoryA GetExitCodeThread GetThreadTimes RtlUnwind

user32

AppendMenuA AppendMenuW SetWindowPos SetWindowTextW GetClassInfoW GetDesktopWindow CreateWindowExW GetDC ReleaseDC MessageBoxA DestroyWindow MessageBoxW GetFocus MonitorFromWindow GetMonitorInfoW PostMessageW SendMessageW CreateCaret GetCapture GetWindowLongPtrW DefWindowProcW LoadCursorW RegisterClassExW SetWindowLongPtrW GetClientRect MoveWindow BeginPaint EndPaint GetWindowDC CreatePopupMenu DestroyMenu ClientToScreen TrackPopupMenuEx InsertMenuItemW SetMenuItemInfoW RedrawWindow UpdateWindow DestroyCaret ShowWindow EnableWindow IsWindowEnabled SetCapture ReleaseCapture GetCursorPos ScreenToClient SetFocus GetWindowRect ScrollWindow ValidateRect CallWindowProcW SetCursor GetWindowTextLengthW GetWindowTextW SetTimer GetSystemMetrics IsZoomed KillTimer OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetKeyState GetWindow SetActiveWindow GetUpdateRect InvalidateRect TrackMouseEvent AdjustWindowRectEx WaitMessage PeekMessageW IsDialogMessageW SetWindowLongW GetWindowLongW SetLayeredWindowAttributes GetForegroundWindow MapVirtualKeyW GetClipboardData MessageBeep GetKeyboardLayout IsWindowVisible SendNotifyMessageW TranslateMessage DispatchMessageW

gdi32

CreateFontIndirectW CreateSolidBrush GetDeviceCaps SetBkMode ChoosePixelFormat SetPixelFormat SwapBuffers CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteObject DeleteDC SetTextColor

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

CryptDestroyKey RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptHashData CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptDestroyHash

shell32

DragFinish SHGetFolderPathW SHFileOperationW DragAcceptFiles SHCreateItemFromParsingName SHBrowseForFolderW SHGetPathFromIDListW DragQueryFileW ShellExecuteW

ole32

CoInitializeEx CoUninitialize CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CreateStreamOnHGlobal ReleaseStgMedium OleUninitialize OleInitialize RegisterDragDrop CoLockObjectExternal RevokeDragDrop CoCreateGuid

oleaut32

SysStringLen SysAllocStringByteLen VariantClear SysFreeString SysAllocString

shlwapi

PathIsRelativeW SHRegGetValueW

imm32

ImmAssociateContext ImmSetCandidateWindow ImmAssociateContextEx ImmIsIME ImmGetCompositionStringW ImmGetVirtualKey ImmReleaseContext ImmGetContext ImmNotifyIME

opencl

clGetPlatformIDs clCreateKernel clGetExtensionFunctionAddressForPlatform clEnqueueWriteBuffer clGetProgramBuildInfo clBuildProgram clCreateProgramWithSource clReleaseProgram clReleaseKernel clEnqueueReadBuffer clCreateCommandQueue clCreateContext clGetDeviceIDs clReleaseContext clReleaseCommandQueue clReleaseMemObject clGetDeviceInfo clCreateBuffer clSetKernelArg clGetPlatformInfo clFinish clCreateFromGLTexture2D clCreateFromGLRenderbuffer clEnqueueAcquireGLObjects clEnqueueNDRangeKernel clEnqueueReleaseGLObjects clEnqueueMapBuffer clEnqueueUnmapMemObject clFlush

gdiplus

GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipDrawRectangleI GdipCreatePen1 GdipDeleteFont GdipDeletePen GdipCreateFromHWND GdipSetWorldTransform GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipCreateFromHDC GdipBitmapUnlockBits GdipBitmapLockBits GdipSetStringFormatAlign GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipDrawImageRectI GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipDeleteGraphics GdipFillRectangleI GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipMeasureString GdipCreateLineBrushFromRectI GdipSetLineWrapMode GdipDrawLineI GdipSetSmoothingMode GdipDrawEllipseI GdipDrawImageRectRectI GdipDrawString GdipCreateBitmapFromHBITMAP GdipGetLogFontW GdipFree GdipDrawImageI GdipSetClipRectI GdipCreateFont GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipDisposeImage

dbghelp

MiniDumpWriteDump

winmm

timeGetTime

wldap32

ord35 ord33 ord32 ord27 ord26 ord200 ord41 ord50 ord30 ord60 ord211 ord46 ord143 ord301 ord22 ord79

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

333KB

Virtual Size

633KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=7, id=199, version=41118,

count=16, id=259, version=26706,

count=35, id=260, version=26706,

count=2, id=203, productName=VS2012 build 50727, version=50727,

count=4, id=257, version=26715,

count=30, id=259, version=29395,

count=1, id=262, version=29395,

count=22, id=224, productName=VS2013 build 21005, version=21005,

count=7, id=261, productName=VS2017 v15.5.2 build 25831, version=25831,

count=42, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,

count=172, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,

count=85, id=260, productName=VS2017 v15.4.5 build 25547, version=25547,

count=115, id=261, version=27045,

count=1, id=259, version=27045,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=10, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=212, id=261, version=29395,

count=35, id=257, version=29395,

count=542, id=1, productName=Unmarked objects,

count=45, id=260, version=29395,

count=130, id=261, version=26706,

count=132, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,