arctic[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
arctic.exe
Size 7.6MB
Sample260922-3t7dcaab76
SHA256 5c6ea309b17df6c83dc64921a40013da6d7b78886e92c0309ae2eb88c435c423
MD5 5d59a6a7911c5710f0a8b528281a10bc
SHA1 762f1ec6f597b10657103e27695e1eb76567ec19
SHA512 7c78f9623aeb3f23a1796ba2c56d98d804c2908bed9b75642fde4ec3059bca3cf343d952773bf794dcb380839b6e5f780c79ba7aefd5ef21d0bf60cdfb0f057b
SSDEEP 98304:0OyF7BPVhyhMy5E9rHcU1Zp1ZkCLa95qDtaqkZKDYgU:0vFpz8U5LNa96r5Dk
TLSH
T1FB86AD43F65281E9C0AEC274D31A9733E772B88D092476EB17E41B212FA6F50AF5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
arctic.exe

File Explorer

arctic.exe

.exe 7.6MB

arctic.exe

IMPHASH d171d6091bcb87234319716dbc8e5928
SHA256 5c6ea309b17df6c83dc64921a40013da6d7b78886e92c0309ae2eb88c435c423
MD5 5d59a6a7911c5710f0a8b528281a10bc
SHA1 762f1ec6f597b10657103e27695e1eb76567ec19
SHA512 7c78f9623aeb3f23a1796ba2c56d98d804c2908bed9b75642fde4ec3059bca3cf343d952773bf794dcb380839b6e5f780c79ba7aefd5ef21d0bf60cdfb0f057b
SSDEEP 98304:0OyF7BPVhyhMy5E9rHcU1Zp1ZkCLa95qDtaqkZKDYgU:0vFpz8U5LNa96r5Dk
TLSH
T1FB86AD43F65281E9C0AEC274D31A9733E772B88D092476EB17E41B212FA6F50AF5D349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3744352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

arctic.pdb

kernel32

EncodePointer GetModuleHandleA GetProcAddress Sleep InitializeSListHead SetUnhandledExceptionFilter CompareStringOrdinal GetCurrentThreadId GlobalFree FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentThread SetLastError QueryPerformanceFrequency GetEnvironmentVariableW LoadLibraryA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetCommandLineW FlsGetValue AddVectoredExceptionHandler HeapReAlloc LoadLibraryW GlobalUnlock GetSystemInfo GlobalLock LoadLibraryExA RtlUnwindEx FormatMessageW RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId ReleaseMutex WaitForSingleObject FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber SleepEx SetHandleInformation ExitProcess GetExitCodeProcess GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW GetProcessId WaitForMultipleObjects SetWaitableTimer GetLastError InitializeCriticalSectionEx GlobalAlloc CreateWaitableTimerExW GetTempPathW GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA MultiByteToWideChar RaiseException LCIDToLocaleName GetUserDefaultUILanguage RtlPcToFileHeader HeapAlloc GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive CreatePipe CancelIoEx WriteFile SetFileCompletionNotificationModes lstrlenW CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW CloseHandle HeapFree DeleteCriticalSection GetModuleHandleW WakeAllConditionVariable CreateFileW FindClose FindNextFileW FindFirstFileExW TerminateProcess GetFullPathNameW SetThreadStackGuarantee SleepConditionVariableSRW SwitchToThread WideCharToMultiByte DuplicateHandle SetEnvironmentVariableW GetProcessHeap FreeLibrary GetSystemTimePreciseAsFileTime LoadLibraryExW OutputDebugStringW OutputDebugStringA

advapi32

RegOpenKeyExW RegGetValueW RegQueryValueExW RegCloseKey RevertToSelf ImpersonateAnonymousToken EventRegister EventSetInformation EventUnregister EventWriteTransfer

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtWriteFile NtReadFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile RtlGetVersion NtCreateNamedPipeFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

ole32

CoUninitialize OleInitialize CoTaskMemAlloc CoInitializeEx CoCreateFreeThreadedMarshaler CoTaskMemFree RegisterDragDrop CoInitialize RevokeDragDrop CoCreateInstance

user32

LoadCursorW SetCursor SetCursorPos InvalidateRect UpdateWindow SystemParametersInfoW GetKeyState MonitorFromPoint EnumDisplayMonitors AdjustWindowRect MonitorFromRect ClipCursor ScreenToClient GetSystemMetrics SetCapture GetClipCursor RedrawWindow PostMessageW ShowCursor DefWindowProcW RegisterRawInputDevices SetWindowTextW GetTouchInputInfo GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity GetWindowLongPtrW GetForegroundWindow ReleaseCapture ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState TrackMouseEvent SetPropW EnableWindow IsWindowVisible GetWindowPlacement SetWindowPlacement FindWindowExW ChangeDisplaySettingsExW AdjustWindowRectEx RegisterClassExW CreateWindowExW SetWindowPos GetMessageA GetMenu TranslateMessage SetParent GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA RegisterTouchWindow IsIconic CloseTouchInputHandle IsWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetParent GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetWindowRgn GetWindow IsWindowEnabled TranslateAcceleratorW SetWindowLongPtrW GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard DestroyWindow FlashWindowEx SetFocus GetMonitorInfoW EnumChildWindows DispatchMessageA GetAsyncKeyState

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteExW SHAppBarMessage ShellExecuteW DragQueryFileW DragFinish SHCreateItemFromParsingName ord190 SHOpenFolderAndSelectItems ord155

gdi32

CreateCompatibleDC DeleteDC SelectObject CreateDIBSection CombineRgn CreateSolidBrush DeleteObject CreateRectRgn BitBlt GetDeviceCaps SetTextColor SetBkMode

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertCloseStore CertGetCertificateChain CertDuplicateStore

ws2_32

send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind getsockopt shutdown ioctlsocket WSASocketW WSASend closesocket recv WSAIoctl getsockname WSAGetLastError getpeername connect

secur32

DecryptMessage ApplyControlToken QueryContextAttributesW FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW FreeCredentialsHandle AcceptSecurityContext EncryptMessage

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscmp wcslen strlen strcpy_s

api-ms-win-crt-runtime-l1-1-0

_initterm _initialize_narrow_environment _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv abort _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment strerror

api-ms-win-crt-math-l1-1-0

trunc floor roundf pow round __setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc malloc _set_new_mode _callnewh free