ava[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ava.exe
Size 2.4MB
Sample261003-17rtpsyamb
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ava.exe

File Explorer

ava.exe

.exe 2.4MB

ava.exe

IMPHASH d411b6b066b17cc7bf1f5c3502ac4e43
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

avavuv

Minor OS version

Major OS version

Entry point

1573880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\avavu\OneDrive\Belgeler\ore esp\sonoyuncu\bin\x64\Release\evangelicy-automine-blur.pdb

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGetProperty BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHashData

ole32

CoInitializeEx CreateStreamOnHGlobal CoCreateInstance CoUninitialize

kernel32

GetSystemTimeAsFileTime ReadFile SizeofResource GetVolumeInformationW WriteProcessMemory GetCurrentProcess OutputDebugStringA GetModuleFileNameW GetProcessId K32GetModuleFileNameExW SetThreadPriority GetTempPathW GetVolumePathNameW CreateFileW GetCurrentThreadId GetModuleHandleA K32EnumProcessModulesEx OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError GetFileAttributesExW Process32NextW K32GetModuleBaseNameW GetCurrentThread LockResource GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetNativeSystemInfo K32GetModuleInformation LoadResource FindResourceW GetLocalTime SwitchToThread GetWindowsDirectoryW Beep GetProcAddress LocalFree ReadProcessMemory GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx InitializeSListHead WideCharToMultiByte QueryFullProcessImageNameW GlobalUnlock IsWow64Process VirtualQueryEx GetExitCodeProcess GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter AreFileApisANSI FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentDirectoryW GetModuleHandleW GlobalLock

user32

GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout IsWindowUnicode SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW PostMessageW EndPaint GetWindow GetWindowRect DestroyWindow IsWindowVisible SetWindowPos EqualRect MessageBoxW MonitorFromWindow SetWindowLongPtrW SetWindowRgn FillRect CreateWindowExW UnionRect ScreenToClient GetSystemMetrics BeginPaint UnregisterClassW SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow MapVirtualKeyW IsIconic GetAncestor LoadImageW SetForegroundWindow GetKeyNameTextA GetAsyncKeyState GetCapture DispatchMessageW GetMonitorInfoW ClientToScreen PeekMessageW MapVirtualKeyA GetForegroundWindow EnumWindows IsRectEmpty SetLayeredWindowAttributes IntersectRect TranslateMessage LoadCursorW SetCapture SetCursor SetRectEmpty GetClientRect GetKeyNameTextW PostQuitMessage SystemParametersInfoW UpdateWindow ReleaseCapture

gdi32

CreateRoundRectRgn CreateRectRgn DeleteDC CreateDIBSection CreateCompatibleDC GetStockObject SelectObject DeleteObject

advapi32

RegGetValueW GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ _Mtx_trylock _Cnd_signal _Thrd_hardware_concurrency _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

gdiplus

GdipDeleteBrush GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipSetPenStartCap GdipCloneImage GdipSetInterpolationMode GdipCreateSolidFill GdipSetStringFormatTrimming GdipCreateRegion GdipFillPath GdipCloneBitmapAreaI GdipDrawLine GdipSetPixelOffsetMode GdipFillRectangle GdipClosePathFigure GdipGetStringFormatFlags GdipGetGenericFontFamilySansSerif GdipFree GdipSetClipRegion GdipDrawPath GdipDrawString GdipDrawImageRect GdipSetPenEndCap GdipGetClip GdipCloneStringFormat GdipSetTextRenderingHint GdipSetClipPath GdipDrawEllipse GdipMeasureString GdipDeleteRegion GdipGetImageGraphicsContext GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipSetCompositingMode GdipDeleteFont GdipGetImageWidth GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipDeletePrivateFontCollection GdipPrivateAddMemoryFont GdipSetStringFormatFlags GdipFlush GdipSetSmoothingMode GdipBitmapSetPixel GdipDisposeImage GdipDeletePath GdipAlloc GdipCreateFontFamilyFromName GdipSetCompositingQuality GdipGetImageHeight GdipDeleteFontFamily GdipCreateStringFormat GdipGetInterpolationMode GdiplusShutdown GdiplusStartup GdipStringFormatGetGenericTypographic GdipCreateBitmapFromStream GdipFillEllipse

winmm

timeBeginPeriod timeEndPeriod

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memchr __std_exception_copy __current_exception memmove __C_specific_handler memcmp memcpy _CxxThrowException __current_exception_context memset __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fgetpos fputs setvbuf __stdio_common_vswprintf __stdio_common_vsprintf ungetc fwrite __stdio_common_vfprintf fsetpos fread _fseeki64 _get_stream_buffer_pointers _set_fmode ftell __acrt_iob_func fseek fgetc _wfopen __stdio_common_vsprintf_s __stdio_common_vsscanf fputc __stdio_common_vswprintf_s _wfsopen fclose fflush __p__commode

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _initialize_onexit_table _set_app_type _invoke_watson _configure_wide_argv _register_onexit_function _initialize_wide_environment _get_wide_winmain_command_line _beginthreadex _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

wcscpy_s strncpy wcsncpy_s strncmp tolower _stricmp strcmp _wcsicmp

api-ms-win-crt-math-l1-1-0

_fdclass _hypotf acosf __setusermatherr remainderf atan2 roundf sin sinf sqrt sqrtf ceilf hypot round powf _dclass fmodf floorf floor expf cosf cos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale