Aero Star NoAuth[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Aero Star NoAuth.exe
Size 6.6MB
Sample260930-1lkhhaww2l
SHA256 a673bd447583618ba97066ec935e2ef3c28e8e16bbb7c4a6fee17b65913a9c76
MD5 4a2222a5e69bd25a28c931a29d523748
SHA1 f6fe4aa51c23a18240cf10e6caa58e9b261b0e10
SHA512 b72e02933fe75f50ee3605f3da50479260019c64fd9d59edf3e61e4d53ada60fc82b3ecd4cbf85857f9f77d0534ff27c388f742702137b84d766aa86d5e8cb73
SSDEEP 98304:Huu1ywRDIBdbDixfXr3UzU+ZzyDRjzJleBk08w4GKhD4s49:Hu6pRMBGD3UzU+ZzyDRJlCkW4t9T4
TLSH
T16966BE6196AC4A9DE026F038C2975617E3F1BC0D1321DFCF96D09D670E2FAD0B67A209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aero Star NoAuth.exe

File Explorer

Aero Star NoAuth.exe

.exe 6.6MB

Aero Star NoAuth.exe

IMPHASH bff876d4350c291fe4294dddd94541c2
SHA256 a673bd447583618ba97066ec935e2ef3c28e8e16bbb7c4a6fee17b65913a9c76
MD5 4a2222a5e69bd25a28c931a29d523748
SHA1 f6fe4aa51c23a18240cf10e6caa58e9b261b0e10
SHA512 b72e02933fe75f50ee3605f3da50479260019c64fd9d59edf3e61e4d53ada60fc82b3ecd4cbf85857f9f77d0534ff27c388f742702137b84d766aa86d5e8cb73
SSDEEP 98304:Huu1ywRDIBdbDixfXr3UzU+ZzyDRjzJleBk08w4GKhD4s49:Hu6pRMBGD3UzU+ZzyDRJlCkW4t9T4
TLSH
T16966BE6196AC4A9DE026F038C2975617E3F1BC0D1321DFCF96D09D670E2FAD0B67A209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4504928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

user32

ReleaseCapture IsWindowUnicode SetCursorPos GetCapture ClientToScreen TranslateMessage DispatchMessageA PeekMessageA SetCapture SetCursor UnregisterClassW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow SetWindowPos SetWindowDisplayAffinity GetAsyncKeyState GetSystemMetrics UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxA GetWindowLongPtrW SetWindowLongPtrW FindWindowA LoadCursorA LoadIconW PostMessageA PostQuitMessage GetMessageExtraInfo GetKeyState TrackMouseEvent SetProcessDPIAware GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard AnimateWindow IsZoomed GetClientRect DefWindowProcW GetCursorPos ScreenToClient GetWindowRect keybd_event OpenClipboard

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA ord680

winmm

joyGetDevCapsW PlaySoundA joyGetNumDevs joyGetPosEx

crypt32

CertFindCertificateInStore CryptStringToBinaryW CertOpenStore CertEnumCertificatesInStore CertGetNameStringW CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CryptProtectData PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CryptDecodeObjectEx CertFindExtension CryptUnprotectData

wintrust

WinVerifyTrust

hid

HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidP_GetCaps HidD_FreePreparsedData

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

ole32

CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoInitializeEx

bcrypt

BCryptHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

msvcp140

?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??7ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit _Cnd_broadcast _Cnd_wait ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xbad_function_call@std@@YAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock _Thrd_yield _Thrd_detach _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

wininet

HttpOpenRequestA InternetCloseHandle InternetConnectA InternetReadFile HttpQueryInfoA HttpSendRequestA InternetOpenA InternetSetOptionA

advapi32

OpenProcessToken CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash GetTokenInformation RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW StartServiceW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptGetHashParam CryptCreateHash CryptHashData

ws2_32

select recvfrom sendto htonl listen accept ioctlsocket __WSAFDIsSet freeaddrinfo inet_pton inet_ntop getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect closesocket WSAGetLastError ntohs WSASetLastError bind connect getpeername getsockname getaddrinfo gethostname htons recv setsockopt socket WSAIoctl

oleaut32

SafeArrayGetUBound SysFreeString SysAllocString SafeArrayGetLBound SafeArrayGetElement VariantInit VariantClear

kernel32

PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW IsDebuggerPresent OutputDebugStringW ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete FindClose FormatMessageW SetLastError FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW EnterCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx CreateFileMappingA UnmapViewOfFile MapViewOfFile GetThreadContext SetThreadPriority GetCurrentThread CreateThread ExitProcess Sleep CloseHandle GetFileAttributesA GetEnvironmentVariableA DeleteFileW GetModuleHandleA GetFileAttributesW GetProcAddress LoadResource LockResource LeaveCriticalSection GetFileType SetFileAttributesW GetTempPathW OutputDebugStringA GetLastError WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleW GetEnvironmentVariableW CreateDirectoryW GetFileSizeEx ReadFile WriteFile LocalFree FreeLibrary LoadLibraryA WideCharToMultiByte OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetStdHandle FlushFileBuffers SetHandleInformation CreatePipe QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap TerminateProcess VirtualAlloc GetModuleFileNameW DeleteFileA GetFileInformationByHandle GetModuleFileNameA SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetTickCount64 WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive FindResourceW InitializeCriticalSection LoadLibraryW SleepEx MoveFileExW GetTickCount SizeofResource CreateFileW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA CreateFileA FindResourceA FreeConsole

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140

_purecall memset memmove memcpy memchr _CxxThrowException __std_exception_destroy wcsstr longjmp __std_exception_copy wcschr __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp strchr strrchr __std_terminate strstr memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strspn _strdup wcspbrk strcspn isdigit wcsncmp strpbrk strncpy_s wcsncpy strlen strncpy _wcsicmp strncmp strcmp strcpy_s tolower wcslen

api-ms-win-crt-runtime-l1-1-0

_exit abort _crt_atexit __sys_nerr __sys_errlist _cexit _c_exit _beginthreadex terminate _initterm exit _seh_filter_exe _set_app_type _invoke_watson _initterm_e _errno _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _initialize_narrow_environment _wassert _initialize_onexit_table _configure_narrow_argv _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc realloc _callnewh calloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul strtol wcstombs strtoull strtoll strtod atoi

api-ms-win-crt-stdio-l1-1-0

fputc fgetc fread _wfopen fsetpos fclose _get_stream_buffer_pointers __stdio_common_vsscanf _fseeki64 fwrite setvbuf fgetpos __stdio_common_vfprintf __acrt_iob_func ungetc __p__commode __stdio_common_vsprintf _close fgets _fileno _write _lseeki64 _read __stdio_common_vsprintf_s _set_fmode ftell fseek _wopen ferror feof fopen_s __stdio_common_vsnprintf_s fflush fputs

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _unlink _lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

tanhf exp sqrt sin cos atan2 asin acosf ceilf pow ldexp tanf __setusermatherr _fdopen roundf powf cosf expf floorf fmod fmodf sinf sqrtf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _time64