Silent illusion[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Silent illusion.exe
Size 7.8MB
Sample261006-vb858aaz9w
SHA256 a232033b025f6a8373ec91dd879d4904d6a3aaea7303c471d088b4b292f5ebdd
MD5 93488067585044c57335e8ef17ed2488
SHA1 1e50641ce948a6b9624eac187e9a89e31470bfe7
SHA512 d643eed7f5b258e575144d93dde66f80211e00183cae31c931dfc7147b43c8371b62ad3a7393bd69b8e5376c565d2b1603654eb634803bdd1c65bf0f56725a6d
SSDEEP 98304:7nKmVeVhe5VlPnmB9oFEcA2YUiEZdmIn/cUwp1plB33RdY:7nZuhe5LnmBGFBA2tiEZ/UjBLY
TLSH
T17F86BF47F3A646D9C137D43C8B42E213FEB278084335A2DBA7A18A565B237E05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Silent illusion.exe

File Explorer

Silent illusion.exe

.exe 7.8MB

Silent illusion.exe

IMPHASH 1e221dc547c300bbada6f6caf4de7df8
SHA256 a232033b025f6a8373ec91dd879d4904d6a3aaea7303c471d088b4b292f5ebdd
MD5 93488067585044c57335e8ef17ed2488
SHA1 1e50641ce948a6b9624eac187e9a89e31470bfe7
SHA512 d643eed7f5b258e575144d93dde66f80211e00183cae31c931dfc7147b43c8371b62ad3a7393bd69b8e5376c565d2b1603654eb634803bdd1c65bf0f56725a6d
SSDEEP 98304:7nKmVeVhe5VlPnmB9oFEcA2YUiEZdmIn/cUwp1plB33RdY:7nZuhe5LnmBGFBA2tiEZ/UjBLY
TLSH
T17F86BF47F3A646D9C137D43C8B42E213FEB278084335A2DBA7A18A565B237E05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8151040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\blood\Downloads\obsidianv2 - testing\obsidianv2 - testing\obsidianv2\x64\Release\Obsidian External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

CreateThread CreateFileMappingW GetModuleFileNameA GetModuleHandleW SetLastError FormatMessageA LocalFree EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx ExitProcess AreFileApisANSI CreateFile2 InitializeCriticalSectionEx FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW CreateProcessA GetLocaleInfoEx GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcessTimes GetTickCount DeleteFileA DeleteCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetFileAttributesExW GetSystemInfo GetFileAttributesA GetTempPathA CreatePipe SetHandleInformation ReadFile MapViewOfFile QueryFullProcessImageNameW K32GetModuleBaseNameA GetCurrentThread Sleep UnmapViewOfFile GetLastError CreateRemoteThread LoadLibraryA VirtualFreeEx WideCharToMultiByte FreeLibrary ReadProcessMemory GetProcAddress VirtualProtectEx CloseHandle Process32FirstW Process32Next Process32NextW K32GetModuleFileNameExA GetExitCodeThread CreateFileW SetThreadPriority GetModuleFileNameW SetPriorityClass QueryPerformanceCounter VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA GlobalUnlock GlobalLock GlobalAlloc GlobalFree MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA Module32First WaitForSingleObject Module32Next WriteProcessMemory Process32First VirtualAllocEx FlushInstructionCache GetCurrentProcess VirtualProtect GetTickCount64

user32

SendInput GetWindowThreadProcessId GetMessageA MonitorFromPoint IsWindowVisible MessageBoxW PostMessageA FillRect SendMessageW GetSystemMetrics GetKeyNameTextA IsWindow EndPaint BeginPaint LoadIconA IsIconic UpdateWindow FindWindowA PostQuitMessage PeekMessageA GetClientRect TranslateMessage SetLayeredWindowAttributes SetWindowDisplayAffinity GetWindowLongA DefWindowProcA RegisterClassA EnumDisplaySettingsA GetMonitorInfoA ClientToScreen ReleaseDC ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW EnumDisplayMonitors SetActiveWindow MonitorFromWindow SetWindowPos GetDC DestroyWindow GetWindowRect DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout MessageBoxA TrackMouseEvent GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo CreateWindowExA MapVirtualKeyA mouse_event SetWindowTextW CreatePopupMenu TrackPopupMenu IsDialogMessageA GetMonitorInfoW GetWindowTextA RegisterClassW EnumWindows DestroyMenu FindWindowW EnumDisplayDevicesW SendMessageA SetWindowLongW AppendMenuW GetWindowLongPtrA SetWindowLongPtrA SetForegroundWindow GetKeyState InvalidateRect GetAsyncKeyState GetForegroundWindow SetWindowLongA SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard

gdi32

DeleteObject SetStretchBltMode DeleteDC StretchBlt CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetStockObject

comdlg32

GetOpenFileNameW

advapi32

RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken GetTokenInformation RegEnumValueA RegQueryInfoKeyA AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteW ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

msvcp140

_Strxfrm ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?setf@ios_base@std@@QEAAHHH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z __crtLCMapStringA __crtLCMapStringW ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Winerror_map@std@@YAHH@Z ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_function_call@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_detach _Thrd_join _Cnd_broadcast _Wcscoll ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

winhttp

WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpSetOption WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpReadData

psapi

GetModuleInformation

ws2_32

ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select ioctlsocket ntohs htons getsockopt getsockname getpeername accept closesocket send setsockopt __WSAFDIsSet socket recv WSAIoctl WSAGetLastError bind listen WSASetLastError WSAStartup htonl connect WSACleanup

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext PFXImportCertStore CryptStringToBinaryA CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptDecodeObjectEx

wldap32

ord30 ord79 ord35 ord200 ord301 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmUpdateThumbnailProperties DwmRegisterThumbnail DwmUnregisterThumbnail DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmExtendFrameIntoClientArea DwmFlush

winmm

timeEndPeriod timeBeginPeriod

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate __std_type_info_compare strchr __RTtypeid strstr strrchr __std_exception_destroy memcpy memmove memset memchr memcmp _CxxThrowException __C_specific_handler __current_exception __current_exception_context longjmp __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode _callnewh malloc realloc free

api-ms-win-crt-string-l1-1-0

isalnum strcpy_s _strdup strcmp isspace strpbrk strncpy strcspn strspn isdigit isupper _stricmp strncmp _wcsicmp wcslen tolower toupper strlen strcat_s

api-ms-win-crt-math-l1-1-0

_hypotf ldexp sinf pow acosf atan2f expf __setusermatherr fmodf floorf _dsign powf sqrt ceilf roundf sqrtf _dclass cosf

api-ms-win-crt-convert-l1-1-0

wcstol mbstowcs strtoll atoi strtod strtol strtoul strtoull

api-ms-win-crt-runtime-l1-1-0

terminate system strerror __sys_nerr _invalid_parameter_noinfo _beginthreadex _errno _resetstkoflw _invalid_parameter_noinfo_noreturn exit _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _getpid _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit abort _crt_atexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-time-l1-1-0

strftime _mktime64 _gmtime64 _localtime64 _localtime64_s _time64

api-ms-win-crt-stdio-l1-1-0

_setmode _close _open _pclose __stdio_common_vsprintf_s _popen __stdio_common_vsprintf _lseek _lseeki64 _set_fmode fputc fflush fclose fgetc __p__commode fwrite _write feof fgetpos setvbuf fputs _read ungetc fsetpos __stdio_common_vswprintf_s __stdio_common_vsscanf _wfopen fread __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fopen fgets

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlink _stat64 _lock_file _access _unlock_file _fstat64

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func _configthreadlocale ___lc_collate_cp_func localeconv

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.obf1

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.obf2

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Silent illusion.exe

d3d11

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

msvcp140

winhttp

psapi

ws2_32

normaliz

crypt32

wldap32

ntdll

wininet

imm32

d3dcompiler_47

dwmapi

winmm

shlwapi

rpcrt4

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic