Ivory[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Ivory.exe
Size 22.3MB
Sample260923-22a5faff46
SHA256 8d271a17d8a6675bf28d90a9740ed3f7a909734d9d5dbcaabaee180572912f14
MD5 9e35e6a6a7d7f4fa734b4ef13453be67
SHA1 5f375fb00b9ebfc3214aa962a8807ccd93963f70
SHA512 a0be3ebac4b66c3d57ae2475ed59ce4cb413ecfa47be25914e607e3a5c85d9479a2494ed1f33d3a40b5dc38bba2e6f73c24a06e573c53f435344cebc880e8c6d
SSDEEP 393216:42JXzz/+NZG5tUx5UwLYm9yElMvK05yRU1oI2kSWprQucNx/vIzsY6rX5IWqCe7q:nmMvKs0UaI2kSWprvqBIoHxqCsuVW
TLSH
T10337BE43F342C590C4568A358D56DBA687327C19AF1217AB3580BF1FBEB32C16E7A781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ivory.exe

File Explorer

Ivory.exe

.exe 22.3MB

Ivory.exe

IMPHASH 8471969a766ae115c4e11da1cb86a5d4
SHA256 8d271a17d8a6675bf28d90a9740ed3f7a909734d9d5dbcaabaee180572912f14
MD5 9e35e6a6a7d7f4fa734b4ef13453be67
SHA1 5f375fb00b9ebfc3214aa962a8807ccd93963f70
SHA512 a0be3ebac4b66c3d57ae2475ed59ce4cb413ecfa47be25914e607e3a5c85d9479a2494ed1f33d3a40b5dc38bba2e6f73c24a06e573c53f435344cebc880e8c6d
SSDEEP 393216:42JXzz/+NZG5tUx5UwLYm9yElMvK05yRU1oI2kSWprQucNx/vIzsY6rX5IWqCe7q:nmMvKs0UaI2kSWprvqBIoHxqCsuVW
TLSH
T10337BE43F342C590C4568A358D56DBA687327C19AF1217AB3580BF1FBEB32C16E7A781
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3287356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Downloads\Ivory-main\Ivory-main\Build\Artifacts\Ivory.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

kernel32

GetCurrentProcess TerminateProcess VirtualProtect Process32FirstW Process32NextW GetThreadContext GetModuleFileNameA ExitProcess VirtualAllocEx GetLastError SetLastError FlushInstructionCache VirtualFreeEx GetModuleHandleW K32EnumProcessModules K32GetModuleBaseNameW WinExec LoadResource LockResource SizeofResource FindResourceW LoadLibraryExA FormatMessageA GetProcessTimes GetSystemTimes K32GetProcessMemoryInfo CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateFileW ReadProcessMemory SetThreadPriority GetCurrentThread CreateThread WaitForSingleObject CloseHandle OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable IsDebuggerPresent InitOnceBeginInitialize SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx LocalFree InitializeCriticalSection GetCurrentThreadId Module32NextW Module32FirstW VirtualProtectEx Module32Next Module32First GetCurrentProcessId WriteProcessMemory SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetLocalTime GetStdHandle Process32Next Process32First CreateToolhelp32Snapshot OpenProcess Sleep GetProcessId GetExitCodeProcess GetConsoleWindow SetConsoleTitleA SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCtrlHandler GetModuleHandleA GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter GetTickCount64 AllocConsole VirtualQueryEx CheckRemoteDebuggerPresent GetSystemInfo SetUnhandledExceptionFilter GetTickCount InitOnceComplete QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA

user32

BeginPaint UpdateWindow BringWindowToTop SetWindowDisplayAffinity SetLayeredWindowAttributes DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage GetClassNameA SetWindowLongA EndPaint SetWindowPos ShowWindow SendInput EnumWindows IsWindowVisible IsWindow FindWindowA GetSystemMetrics GetWindowThreadProcessId GetWindowTextA mouse_event keybd_event MapVirtualKeyA GetKeyNameTextA GetAsyncKeyState SetProcessDPIAware LoadCursorA ScreenToClient GetWindowRect MessageBoxA OpenClipboard CloseClipboard LoadIconA SetForegroundWindow ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData

gdi32

GetStockObject

advapi32

SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteW

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSendRequest WinHttpReadData

msvcp140

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_function_call@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?rdstate@ios_base@std@@QEBAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Query_perf_counter _Query_perf_frequency ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??Bios_base@std@@QEBA_NXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$numpunct@D@std@@2V0locale@2@A _Xtime_get_ticks ?setf@ios_base@std@@QEAAHHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Cnd_broadcast _Cnd_signal _Thrd_yield ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??7ios_base@std@@QEBA_NXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Thrd_join _Thrd_id _Cnd_wait _Thrd_hardware_concurrency _Mtx_trylock ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?good@ios_base@std@@QEBA_NXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

crypt32

CryptQueryObject CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CertCreateCertificateChainEngine

ws2_32

accept WSAEventSelect WSAEnumNetworkEvents bind connect closesocket htonl htons WSACleanup inet_ntop WSASetLastError WSAResetEvent ntohs inet_pton WSAGetLastError WSACreateEvent WSACloseEvent getpeername listen gethostname getsockopt getsockname WSAIoctl ioctlsocket sendto recvfrom recv __WSAFDIsSet send freeaddrinfo WSAStartup setsockopt getaddrinfo select socket WSAWaitForMultipleEvents

winmm

waveOutSetVolume mciSendStringA PlaySoundA timeBeginPeriod

bcrypt

BCryptGenRandom

vcruntime140

__std_terminate memcmp strstr memchr strchr memset longjmp strrchr wcschr __current_exception __current_exception_context __intrinsic_setjmp memmove __C_specific_handler __std_exception_copy __std_exception_destroy _CxxThrowException memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __sys_errlist __sys_nerr abort _beginthreadex terminate system exit _errno _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table strerror

api-ms-win-crt-math-l1-1-0

_fdsign _dsign powf pow logf log atan2f sinf cosf asinf exp _fdclass log10 tan acosf fmodf lround _ldclass _dclass lroundf cos roundf _fdopen atan2 acos round sin expf fmod __setusermatherr ldexp frexp asin tanf nearbyint _ldsign

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode calloc malloc realloc

api-ms-win-crt-string-l1-1-0

isalnum isalpha _strlwr_s _wcsicmp wcscmp isspace _stricmp isdigit toupper wcspbrk strlen _wcsdup strncpy_s tolower strspn isxdigit strpbrk wcslen strcpy wcsncmp wcsncpy strcspn isupper strcoll iscntrl isgraph _strdup ispunct strcpy_s strncmp strcmp islower strncpy

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsscanf fwrite _set_fmode ftell fseek fgetc tmpnam _read _write fgetpos _fileno _close _get_stream_buffer_pointers fread fputc fsetpos _fseeki64 setvbuf ungetc fflush fclose _lseeki64 _wfopen __acrt_iob_func tmpfile _popen _pclose _ftelli64 clearerr fputs fgets __stdio_common_vsprintf _wopen getc freopen fopen __stdio_common_vfprintf freopen_s ferror feof fopen_s __stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

strtod wcstombs atoi strtoul strtoll atof strtof strtoull strtol

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

remove _unlink _lock_file _fstat64 _unlock_file _wstat64 rename

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func setlocale _configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_localtime64 _mktime64 _gmtime64 _difftime64 clock _localtime64_s strftime _time64

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

652KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14.4MB

Virtual Size

14.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Ivory.exe

d3d11

dwmapi

kernel32

user32

gdi32

advapi32

shell32

winhttp

msvcp140

msvcp140_atomic_wait

imm32

d3dcompiler_47

crypt32

ws2_32

winmm

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic