perpetual[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
perpetual.exe
Size 20.1MB
Sample261002-mnfqfazzh1
SHA256 46dadd5e59943fd9ea2672a1a34008c8a8024a591c4fd41f6e0bf826b2c0610b
MD5 b7c92e2c9cfe2e36d5d6a180229fd2de
SHA1 cc268aa422fb902cd6e61b1a5e8d8aff76415d4c
SHA512 da93dc7c2c6e5b4b511856ad6a83405c108588d50945dbe49d7d025d142693ad3bd7e50044f1713bdd85313a89da4b8473a93259e577a59c0826909a3ecbc032
SSDEEP 393216:81CTvcTbBbfzCTzZT/OCiafzHTlcT/3CntvsEbMQkTcIkoiOo8WADacINo0bo8n4:sbfzCTzZT/OCiafzHTlcT/3C2TcIkoiv
TLSH
T1C1271222F2E542D9E87BE074C9565F07E372748503309AEB23E4499A1F57BF049BBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
perpetual.exe

File Explorer

perpetual.exe

.exe 20.1MB

perpetual.exe

IMPHASH 84474ad619cf56da76f16d1d33d76781
SHA256 46dadd5e59943fd9ea2672a1a34008c8a8024a591c4fd41f6e0bf826b2c0610b
MD5 b7c92e2c9cfe2e36d5d6a180229fd2de
SHA1 cc268aa422fb902cd6e61b1a5e8d8aff76415d4c
SHA512 da93dc7c2c6e5b4b511856ad6a83405c108588d50945dbe49d7d025d142693ad3bd7e50044f1713bdd85313a89da4b8473a93259e577a59c0826909a3ecbc032
SSDEEP 393216:81CTvcTbBbfzCTzZT/OCiafzHTlcT/3CntvsEbMQkTcIkoiOo8WADacINo0bo8n4:sbfzCTzZT/OCiafzHTlcT/3C2TcIkoiv
TLSH
T1C1271222F2E542D9E87BE074C9565F07E372748503309AEB23E4499A1F57BF049BBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

184288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW

bcrypt

BCryptVerifySignature BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptGetProperty

crypt32

CryptUnprotectData CryptProtectData

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW SetFileSecurityW GetTokenInformation GetSecurityDescriptorDacl OpenProcessToken SetSecurityInfo

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

SetFilePointerEx GetProcessHeap SetStdHandle HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode WriteConsoleW LCMapStringW GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType ReadFile SetFileInformationByHandle WriteFile CloseHandle GetLastError SetLastError WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW FreeLibrary GetModuleFileNameW LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree MoveFileExW FileTimeToSystemTime SystemTimeToFileTime MultiByteToWideChar QueryPerformanceCounter GetSystemTimePreciseAsFileTime FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx WideCharToMultiByte SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCPInfo IsProcessorFeaturePresent ExitProcess TerminateProcess GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect

Name

.text

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19.7MB

Virtual Size

19.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

perpetual.exe

user32

bcrypt

crypt32

advapi32

shell32

ole32

kernel32

generic