azimuth[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
azimuth.exe
Size 2.9MB
Sample261011-tp5jhsda64
SHA256 5d3ce30b440dab2604fe42ff7cd129394f0b98418e22b2a44270f548199bc6a9
MD5 0b6cd1040db1f1214cf805a4f43ef800
SHA1 28e226f2516a871c7608d016cd5190e37f0eefdb
SHA512 f5926bbba46459c4507161d0aec53bbcb2f30b7ad175a33d33a08fabe97f03203b135ae44555b65b8bb43163b6e6482acc378a5c2337b6c62cfb9584b0f3c5b0
SSDEEP 49152:h1iMabyEvQqwKQuMq/yQ+XYrBuR5U+mNYt9uFyXXBwDXrT0e7Bf/Mt:h1sacKpZwLrw
TLSH
T1ECE57E27A39801ECE077C279CF879A46E7B2740503716BDF069096661F27EE54E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
azimuth.exe

File Explorer

azimuth.exe

.exe 2.9MB

azimuth.exe

IMPHASH 530264fc99e3c00f0e6a2fe6d2ae5db5
SHA256 5d3ce30b440dab2604fe42ff7cd129394f0b98418e22b2a44270f548199bc6a9
MD5 0b6cd1040db1f1214cf805a4f43ef800
SHA1 28e226f2516a871c7608d016cd5190e37f0eefdb
SHA512 f5926bbba46459c4507161d0aec53bbcb2f30b7ad175a33d33a08fabe97f03203b135ae44555b65b8bb43163b6e6482acc378a5c2337b6c62cfb9584b0f3c5b0
SSDEEP 49152:h1iMabyEvQqwKQuMq/yQ+XYrBuR5U+mNYt9uFyXXBwDXrT0e7Bf/Mt:h1sacKpZwLrw
TLSH
T1ECE57E27A39801ECE077C279CF879A46E7B2740503716BDF069096661F27EE54E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1951468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

azimuth.pdb

user32

GetClientRect TranslateMessage PeekMessageW DispatchMessageW IsWindow ShowWindow MsgWaitForMultipleObjects GetWindow PostMessageW ReleaseDC GetCursorPos GetDC EnableWindow LoadImageW SystemParametersInfoW SetCursor LoadCursorW SetFocus IsWindowEnabled GetForegroundWindow SetWindowPlacement SetForegroundWindow DrawTextW GetMonitorInfoW CharUpperBuffW GetKeyState SetTimer KillTimer MsgWaitForMultipleObjectsEx GetWindowThreadProcessId GetMessageW DefWindowProcW AdjustWindowRectEx MessageBoxW DestroyWindow IsWindowVisible SetWindowPos MonitorFromWindow SetWindowLongPtrW CreateWindowExW GetSystemMetrics GetWindowLongPtrW RegisterClassExW GetWindowPlacement GetAsyncKeyState

gdi32

GdiFlush SetBrushOrgEx BitBlt CreateCompatibleBitmap SaveDC SelectObject CreateDIBSection CreateCompatibleDC GdiAlphaBlend StretchDIBits CreateFontW DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode SetBkColor SetStretchBltMode RestoreDC DeleteObject ExtTextOutW IntersectClipRect

shell32

SHCreateItemFromParsingName

ole32

CoTaskMemAlloc CoGetApartmentType CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

d3d12

ord101 D3D12SerializeRootSignature ord102

dxgi

CreateDXGIFactory2

d3dcompiler_47

D3DCompile

bcrypt

BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptHashData BCryptCloseAlgorithmProvider

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess GetStdHandle SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount WriteConsoleW RtlUnwindEx GetStartupInfoW InitializeSListHead LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize GetFileType GetConsoleOutputCP GetConsoleMode IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo GetStringTypeW LCMapStringEx EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MoveFileExW GetSystemTimeAsFileTime InitializeCriticalSectionEx OutputDebugStringA IsDebuggerPresent SetThreadDescription GetLocaleInfoEx CompareStringOrdinal GetFileAttributesW ResolveLocaleName GetTickCount64 GetCurrentThread WaitForSingleObject ReadFile GetFileSizeEx RtlCaptureContext GetCurrentProcess WriteFile TerminateProcess GetEnvironmentVariableW CreateFileW GetCurrentThreadId GetThreadDescription RtlCaptureStackBackTrace CreateEventW Sleep GetLastError SetEvent CloseHandle RaiseException CreateThread GetProcAddress LocalFree GetCurrentProcessId GetModuleHandleW OpenThread LoadLibraryExW SetUnhandledExceptionFilter VirtualProtect SetLastError VirtualFree VirtualAlloc GetUserDefaultLocaleName FlushInstructionCache SetWaitableTimer ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency CreateWaitableTimerExW QueryPerformanceCounter SetEnvironmentVariableW GlobalMemoryStatusEx VirtualQuery FindFirstFileExW GetFullPathNameW FindNextFileW RemoveDirectoryW FindClose MultiByteToWideChar DeleteFileW WideCharToMultiByte SetDefaultDllDirectories GetModuleFileNameW GetCurrentPackageFullName WritePrivateProfileStringW GetPrivateProfileStringW CreateDirectoryW GetSystemTime GetFileAttributesExW GetModuleHandleExW FreeLibrary RtlAddFunctionTable RtlDeleteFunctionTable GetSystemDirectoryW GetProcessId GetThreadId GetQueuedCompletionStatus UnmapViewOfFile ReleaseSRWLockShared GetOverlappedResultEx AcquireSRWLockShared CreateFileMappingW GetProcessIdOfThread CancelWaitableTimer WaitForSingleObjectEx SetWaitableTimerEx SwitchToThread SleepEx HeapFree HeapAlloc GetProcessHeap DecodePointer RtlPcToFileHeader FormatMessageW GetFileInformationByHandleEx SetFilePointer SetEndOfFile GetACP GetDiskFreeSpaceExW SetFilePointerEx CopyFileW FlushFileBuffers GetSystemTimePreciseAsFileTime TrySubmitThreadpoolCallback FlushProcessWriteBuffers DuplicateHandle WaitForMultipleObjects GetWriteWatch AddVectoredExceptionHandler TryAcquireSRWLockExclusive GetProcessAffinityMask FormatMessageA WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetExitCodeThread GetNativeSystemInfo InitOnceComplete InitOnceBeginInitialize FindFirstFileW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI