Xanthophyll_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Xanthophyll_x64.exe
Size 93KB
Sample261014-vbcf9avz3p
SHA256 d77934c528ff2684f1b585c7bb8f3ded56cf4fba786978c41f3fcc3c978af38e
MD5 c29c29c1775c1f1c827ea3e327604061
SHA1 c7e8d86705e2a937b1ac31b634f751c63de69696
SHA512 3f55c343ceb9ab2fd63d12169dc50fb630bd1d8f41501dc0f724c4b73fe462c78cd38185283bd48aec29b999bd7ba927a17b5a0af2c72319a3999e782649ce7c
SSDEEP 1536:mAqd4JsZ2+i1uRfAF1EWbYXVx9/fN6oGlL0nq9+v:M4IWF1E/Xf9/fQoUyv
TLSH
T145933A92234840E5E31E92B8886E7977E332BC56D78299CF1FD4AC04BF76DC49E72905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xanthophyll_x64.exe

File Explorer

Xanthophyll_x64.exe

.exe 93KB

Xanthophyll_x64.exe

IMPHASH 19d246dae024aac3d39db37e275d00a9
SHA256 d77934c528ff2684f1b585c7bb8f3ded56cf4fba786978c41f3fcc3c978af38e
MD5 c29c29c1775c1f1c827ea3e327604061
SHA1 c7e8d86705e2a937b1ac31b634f751c63de69696
SHA512 3f55c343ceb9ab2fd63d12169dc50fb630bd1d8f41501dc0f724c4b73fe462c78cd38185283bd48aec29b999bd7ba927a17b5a0af2c72319a3999e782649ce7c
SSDEEP 1536:mAqd4JsZ2+i1uRfAF1EWbYXVx9/fN6oGlL0nq9+v:M4IWF1E/Xf9/fQoUyv
TLSH
T145933A92234840E5E31E92B8886E7977E332BC56D78299CF1FD4AC04BF76DC49E72905
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent CreateThread LoadLibraryA TerminateThread GetExitCodeThread WaitForSingleObject SetThreadPriority GetCurrentProcessId ExitProcess GetProcAddress CloseHandle CreateFileA GetLastError GetModuleHandleA OpenProcess SetFilePointer WriteFile GetCurrentProcess SetPriorityClass GetProcessHeap Sleep QueryPerformanceCounter RtlVirtualUnwind UnhandledExceptionFilter RtlCaptureContext SetUnhandledExceptionFilter TerminateProcess

user32

MessageBoxA ExitWindowsEx GetSystemMetrics InvalidateRect UnionRect EnumDisplayMonitors GetDC

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC PatBlt PlgBlt DeleteDC CreatePen Polygon DeleteObject CreateSolidBrush

advapi32

CryptGenRandom CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownExA OpenProcessToken CryptAcquireContextA

msvcp140

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z

msimg32

GradientFill TransparentBlt

winmm

midiOutOpen waveOutOpen midiOutShortMsg waveOutUnprepareHeader waveOutPrepareHeader midiOutReset waveOutWrite midiOutClose waveOutReset

psapi

EnumProcesses

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException __current_exception __current_exception_context memset __std_exception_destroy memmove memchr memcpy __std_exception_copy __std_terminate

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _seh_filter_exe terminate _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit exit _initterm _get_narrow_winmain_command_line _set_app_type _initterm_e _cexit _crt_atexit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

sin tanf sinf sqrtf cos __setusermatherr cosf

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale