melatonin[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
melatonin.exe
Size 4.7MB
Sample261002-pffrks1bme
SHA256 caa7b39f276cf0820540a97689e91bd9592ca5778843be27556ed21d65caed9a
MD5 e441e0b1bfdf6e3c19947d11ce2ff680
SHA1 fbc16bfff8395b5fd88ccc0a87935a645b94d24b
SHA512 f3887f9dd68d39a7351762a653cae67a4bd73cfae5ef77318ee91176a2e8429be583ea7714d77abd0da2766e53817643a94e0310db5b55cbfa47408f5d18e798
SSDEEP 98304:xWLAECg6MYKl/YOLPIZzdNBpyOwmj/IBc3rYl4kzyoZqgH+C:xWLX6tKBYyWzHryeziLl4kzyTgH
TLSH
T18736F146B2A401F8C56BE03CC647FA1BE7363849033056EB67E84A566F637E16F7A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
melatonin.exe

File Explorer

melatonin.exe

.exe 4.7MB

melatonin.exe

IMPHASH 39fab9407ce6c353022ac8b1c95db092
SHA256 caa7b39f276cf0820540a97689e91bd9592ca5778843be27556ed21d65caed9a
MD5 e441e0b1bfdf6e3c19947d11ce2ff680
SHA1 fbc16bfff8395b5fd88ccc0a87935a645b94d24b
SHA512 f3887f9dd68d39a7351762a653cae67a4bd73cfae5ef77318ee91176a2e8429be583ea7714d77abd0da2766e53817643a94e0310db5b55cbfa47408f5d18e798
SSDEEP 98304:xWLAECg6MYKl/YOLPIZzdNBpyOwmj/IBc3rYl4kzyoZqgH+C:xWLX6tKBYyWzHryeziLl4kzyTgH
TLSH
T18736F146B2A401F8C56BE03CC647FA1BE7363849033056EB67E84A566F637E16F7A710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1402736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\2121\Desktop\melatoninv2\x64\Release\main.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winmm

timeEndPeriod timeBeginPeriod

kernel32

GetModuleHandleA VirtualProtect VirtualAlloc GetCurrentThreadId MultiByteToWideChar Sleep GetTickCount64 GetLastError DeleteFileA ExitProcess WideCharToMultiByte CreateDirectoryA Process32First WriteProcessMemory Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle Module32FirstW VirtualProtectEx VirtualAllocEx ReadProcessMemory Module32NextW VirtualFreeEx QueryPerformanceFrequency QueryPerformanceCounter VirtualQueryEx GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary SetConsoleTitleA GetConsoleWindow SetThreadPriority GetCurrentThread GetTickCount SetLastError GetSystemInfo GetCurrentProcessId InitOnceBeginInitialize CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemTimeAsFileTime SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree InitOnceComplete WakeAllConditionVariable SetUnhandledExceptionFilter FlushInstructionCache InitializeSListHead GetModuleHandleW

user32

IsWindowUnicode SetCursor DefWindowProcW DispatchMessageA DestroyWindow SetWindowPos GetSystemMetrics SetWindowLongA SetWindowDisplayAffinity MoveWindow CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage ScreenToClient ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState GetWindowThreadProcessId SetWinEventHook RegisterClassExA UpdateWindow UnhookWinEvent SetForegroundWindow GetCapture LoadCursorA SendInput IsWindowVisible EnumWindows FindWindowA MessageBoxA SetCapture GetMessageExtraInfo GetKeyboardLayout TrackMouseEvent ShowWindow GetForegroundWindow ClientToScreen GetWindowTextA GetClassNameA GetKeyState GetClientRect

shell32

SHGetFolderPathA

ole32

CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z _Mtx_unlock _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp _CxxThrowException memcmp memchr memset memmove __current_exception_context longjmp strrchr strstr __std_terminate __std_exception_copy __std_exception_destroy memcpy __C_specific_handler __current_exception

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode _callnewh free

api-ms-win-crt-stdio-l1-1-0

fputc __acrt_iob_func fflush _wfopen fseek ftell fclose fgetc __stdio_common_vfprintf _fseeki64 _set_fmode fwrite __p__commode __stdio_common_vsprintf _get_stream_buffer_pointers __stdio_common_vsscanf fread fsetpos ungetc setvbuf fgetpos

api-ms-win-crt-math-l1-1-0

log logf nearbyint roundf sinf _dsign _fdclass acosf atan2f cosf fmodf ldexp ceil ceilf pow sqrtf __setusermatherr powf round

api-ms-win-crt-convert-l1-1-0

strtoull atof strtoll strtod strtol

api-ms-win-crt-runtime-l1-1-0

_exit system __p___argc __p___argv _c_exit _initterm_e _get_initial_narrow_environment _set_app_type _errno _seh_filter_exe _beginthreadex _register_thread_local_exe_atexit_callback _cexit terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _initterm exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-string-l1-1-0

_stricmp _wcsicmp tolower isalnum strcpy_s toupper strncmp strcmp isdigit wcslen strcpy strlen strncpy

api-ms-win-crt-utility-l1-1-0

qsort