antirus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
antirus.exe
Size 2.6MB
Sample261014-z2hs6ssvb1
SHA256 52b3abd8d39c1c1294ebcb479f79603ba61a0613581091c3f0fb6381ad4e6f0c
MD5 278a21c170693e60bf236774403b4e12
SHA1 491c4e00c3592697a16ea61680f155f8051877f6
SHA512 378d8834484ceddee854ba3448cde9ad88bf686999dbbc96d182564339424d5629fa230663eca3da867cf280556fd42e5807a48a60738b94354a9c60e65322ef
SSDEEP 49152:ex/xxuiRoJh980DLQowzWXCcQAp3ZMp0:SxxuiH0DLQRGd
TLSH
T155C55EE7439A82D0E44D6374562E6FF136B5F4C96B108CCF523AAC105942AEF6F3C698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
antirus.exe

File Explorer

antirus.exe

.exe 2.6MB

antirus.exe

IMPHASH f6ea1d623aaca461a69ce629c051b204
SHA256 52b3abd8d39c1c1294ebcb479f79603ba61a0613581091c3f0fb6381ad4e6f0c
MD5 278a21c170693e60bf236774403b4e12
SHA1 491c4e00c3592697a16ea61680f155f8051877f6
SHA512 378d8834484ceddee854ba3448cde9ad88bf686999dbbc96d182564339424d5629fa230663eca3da867cf280556fd42e5807a48a60738b94354a9c60e65322ef
SSDEEP 49152:ex/xxuiRoJh980DLQowzWXCcQAp3ZMp0:SxxuiH0DLQRGd
TLSH
T155C55EE7439A82D0E44D6374562E6FF136B5F4C96B108CCF523AAC105942AEF6F3C698
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

758848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

antirus.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

ole32

CoCreateInstance CoInitialize

shell32

ShellExecuteA ShellExecuteW

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

user32

AdjustWindowRect ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics IsWindowUnicode LoadCursorW MonitorFromWindow OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendInput SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l atof btowc mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstof wcstol wcstoll wcstoul wcstoull wctob

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf atan2f lroundf pow powf

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr strchr wcsrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _ftelli64 _wfopen fclose fflush fopen fputc fread fseek ftell fwrite setbuf

api-ms-win-crt-string-l1-1-0

_isctype_l _iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isalpha mbrlen strcmp strncmp strncpy tolower toupper wcslen

api-ms-win-crt-utility-l1-1-0

qsort

kernel32

AcquireSRWLockExclusive CloseHandle CreateDirectoryA CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlsAlloc FlsGetValue FlsSetValue FormatMessageA FreeLibrary GetCurrentThreadId GetExitCodeProcess GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemInfo GetSystemTimePreciseAsFileTime GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LocalFree Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

antirus.exe

d3d11

d3dcompiler_47

dwmapi

ole32

shell32

gdi32

user32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic