Intellect (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Intellect (1).exe
Size 1.2MB
Sample260930-lbkcesszev
SHA256 861a2853f93b00869758b35094f61d455138ccd7b5fb61662b25e030d7df9849
MD5 98f84e56aaeefff50501d5705bee9b75
SHA1 6d9e0b8866b9e8704ea2ca2cf99691f84b3d92a5
SHA512 1efa01e94acef69ddf7c77ea749512ffc02cf8ac7b2882d5d118e5f19cc261d67cc5a62342f50c178169d15510f0c5029828358e21ccc560706e01030285f80d
SSDEEP 24576:ZP/skXajB6f8RGpG43KRbcvLJMn2ghjqq:Z/sWajB6fNB3+K+nLh
TLSH
T12E459E59A3E901F9F0B7903899A57207E6723C5A07304BCF63D4256A3F736E05E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Intellect (1).exe

File Explorer

Intellect (1).exe

.exe 1.2MB

Intellect (1).exe

IMPHASH f2a7fa90ed2a235cdc840a1a4c5fe635
SHA256 861a2853f93b00869758b35094f61d455138ccd7b5fb61662b25e030d7df9849
MD5 98f84e56aaeefff50501d5705bee9b75
SHA1 6d9e0b8866b9e8704ea2ca2cf99691f84b3d92a5
SHA512 1efa01e94acef69ddf7c77ea749512ffc02cf8ac7b2882d5d118e5f19cc261d67cc5a62342f50c178169d15510f0c5029828358e21ccc560706e01030285f80d
SSDEEP 24576:ZP/skXajB6f8RGpG43KRbcvLJMn2ghjqq:Z/sWajB6fNB3+K+nLh
TLSH
T12E459E59A3E901F9F0B7903899A57207E6723C5A07304BCF63D4256A3F736E05E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

440384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Starz\Desktop\projects\INT\Intellect Loader\examples\example_win32_directx11\REL\Intellect.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

dxgi

CreateDXGIFactory

kernel32

QueryPerformanceCounter WriteProcessMemory FindFirstFileA GetCurrentProcess WriteFile FindNextFileA FindClose WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetTempPathA GetTickCount64 GetLastError Process32NextW MoveFileExA CreateFileA DeleteFileA Process32FirstW CloseHandle VirtualAllocEx ReadProcessMemory GetCurrentProcessId CreateRemoteThread VirtualFreeEx TerminateProcess Sleep GetCurrentThread GetThreadContext LocalFree CreateDirectoryA IsDebuggerPresent GetSystemTime HeapReAlloc SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP FreeLibrary IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation OutputDebugStringW MultiByteToWideChar GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapFree HeapAlloc ReadConsoleW GetConsoleMode SetFilePointerEx ExitProcess FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetProcAddress QueryPerformanceFrequency LoadLibraryA CreateFileW HeapSize GetModuleHandleA GlobalUnlock GetStdHandle ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue WideCharToMultiByte GlobalLock GlobalFree GetACP GlobalAlloc TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW SetEndOfFile GetFileSizeEx RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

TranslateMessage SetLayeredWindowAttributes PeekMessageW SetWindowLongA DispatchMessageW IsWindow ShowWindow UpdateWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetKeyState SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient PostQuitMessage GetCursorPos DestroyWindow RegisterClassExW GetWindowRect SetWindowPos GetWindowLongW DefWindowProcW UnregisterClassW PostMessageA CreateWindowExW GetSystemMetrics

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

SHGetFolderPathA ShellExecuteA SHGetKnownFolderPath

ole32

CoTaskMemFree

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptFinishHash

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

crypt32

CryptUnprotectData CryptProtectData

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

Name

.text

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Intellect (1).exe

d3d11

d3dcompiler_43

dxgi

kernel32

user32

advapi32

shell32

ole32

imm32

dwmapi

bcrypt

d3dx11_43

crypt32

winhttp

generic