Oblyus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Oblyus.exe
Size 741KB
Sample261011-pn9dvsvs5j
SHA256 d84d77003389abb46955badf38b7ac3d9dc4de7037a4988878bf1689dd9ac4e9
MD5 ef3a4b0245c0a120eed532c23b0e1ee3
SHA1 935809d23b7de1491ce67573fc151976354a2201
SHA512 8967418eb12bdaf5ac720f1fa5fe04e20dd9d13f74599244309e1c1012a038f6aea34911ff940f8e72cb4cdc8a94589632419ae508e09be749e9024c286c5d41
SSDEEP 12288:+MWwaDS84DAH9TZgUfHCXlolfsXGPz9HD5yV0AgSr1U:+MrC+DrgHwolewdD5B7SJU
TLSH
T124F49E22A7E801FCD07AD17ACE864917F772780A07715BCF13904AAA1F776E44E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oblyus.exe

File Explorer

Oblyus.exe

.exe 741KB

Oblyus.exe

IMPHASH 2336e5c76c8a03120dfb251f441a3ade
SHA256 d84d77003389abb46955badf38b7ac3d9dc4de7037a4988878bf1689dd9ac4e9
MD5 ef3a4b0245c0a120eed532c23b0e1ee3
SHA1 935809d23b7de1491ce67573fc151976354a2201
SHA512 8967418eb12bdaf5ac720f1fa5fe04e20dd9d13f74599244309e1c1012a038f6aea34911ff940f8e72cb4cdc8a94589632419ae508e09be749e9024c286c5d41
SSDEEP 12288:+MWwaDS84DAH9TZgUfHCXlolfsXGPz9HD5yV0AgSr1U:+MrC+DrgHwolewdD5B7SJU
TLSH
T124F49E22A7E801FCD07AD17ACE864917F772780A07715BCF13904AAA1F776E44E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

user32

UnregisterClassW GetDC SetWindowDisplayAffinity EqualRect TranslateMessage DispatchMessageW SetWindowPos LoadCursorW SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW ReleaseDC RegisterWindowMessageW GetWindowLongPtrW SetProcessDpiAwarenessContext FindWindowW MessageBoxW GetForegroundWindow MsgWaitForMultipleObjectsEx UnregisterHotKey RegisterHotKey GetUserObjectInformationW CloseDesktop OpenInputDesktop MonitorFromPoint GetWindow GetWindowThreadProcessId EnumWindows GetWindowLongW AdjustWindowRectExForDpi GetWindowTextLengthW GetKeyState GetClipboardData CloseClipboard OpenClipboard IsIconic GetDpiForSystem DestroyIcon GetCursorPos TrackPopupMenuEx AppendMenuW DestroyMenu CreatePopupMenu PostMessageW SetWindowLongPtrW MonitorFromRect EndPaint BeginPaint SetForegroundWindow SetActiveWindow KillTimer SetTimer SetFocus IsWindowVisible TrackMouseEvent GetDpiForWindow SystemParametersInfoW GetClientRect InvalidateRect ReleaseCapture SetCapture CreateIconIndirect LoadImageW LoadIconW EnumDisplayMonitors GetMonitorInfoW EnumDisplaySettingsW PeekMessageW

gdi32

BitBlt CreateBitmap GdiFlush CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC

shell32

ShellExecuteA SHQueryUserNotificationState SHFileOperationW SHCreateDirectoryExW SHGetKnownFolderPath Shell_NotifyIconGetRect SHGetFolderPathW Shell_NotifyIconW

advapi32

RegDeleteTreeW RegCreateKeyExW RegDeleteKeyValueW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

kernel32

SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc GetCommandLineW GetCommandLineA ExitProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ReadConsoleW GetEnvironmentStringsW LoadLibraryExW TlsFree FreeEnvironmentStringsW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP ExitThread GetOEMCP GetSystemTimeAsFileTime SetStdHandle HeapSize SetEnvironmentVariableW TlsSetValue HeapQueryInformation GetProcessHeap CreateFileW WriteConsoleW SetEndOfFile CreateThread SetWaitableTimer CloseHandle SetEvent WaitForSingleObject CreateEventW FreeLibrary GetProcAddress LoadLibraryW CreateDirectoryW GetFileAttributesW GetModuleFileNameW CopyFileW MultiByteToWideChar WideCharToMultiByte GetModuleHandleW GetTickCount64 GetLastError GetProcessTimes GetCurrentProcess GetCurrentProcessId OpenProcess GetSystemInfo GlobalUnlock GlobalLock QueryFullProcessImageNameW K32GetProcessMemoryInfo QueryPerformanceCounter QueryPerformanceFrequency ReleaseMutex CreateMutexW RtlUnwind CreateWaitableTimerExW CreateWaitableTimerW GetSystemPowerStatus GetEnvironmentVariableW CompareFileTime DeleteFileW GetFileAttributesExW TerminateProcess CreateProcessW GetSystemDirectoryW MoveFileExW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive

bcrypt

BCryptDestroyKey BCryptVerifySignature BCryptHash BCryptImportKeyPair

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

Name

.text

Size

506KB

Virtual Size

506KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Oblyus.exe

d3d11

dxgi

dcomp

d3dcompiler_47

d2d1

dwrite

dwmapi

avrt

ole32

user32

gdi32

shell32

advapi32

kernel32

bcrypt

winhttp

generic