ix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ix.exe
Size 245KB
Sample261023-mvhhlsa17x
SHA256 0db577b5684112827e43c0a6477fa92aab020cf331765426453b8d951fddd256
MD5 95f380cc7e37e3f2f8ae03bcfd1890a0
SHA1 68d64905ee58bdd3620f8e3739944dfa7de8d977
SHA512 f6a9aca6f963c0df6fe44adf0704a48b8d0b42b55fa529e0fcd02e34ea79a7470441d7910c151d2adc145869cd9a87e2945f9ce59e372f85d8cf1747f2061371
SSDEEP 3072:eyGE9f/m5BhEJ5wj2WEpBIOa7I4cajeBKu4KfN2gkRj4FSbSx+kFyh:DGEBsuJ5wYpBIZ3tNMS3kFyh
TLSH
T10E3406B76EA19CD7C705423AA1F7C6251238EFC04BB247431B12F6351933E9CAF9A646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ix.exe

File Explorer

ix.exe

.exe 245KB

ix.exe

IMPHASH d208c1d2ef12c895e1e0033aabf1b9df
SHA256 0db577b5684112827e43c0a6477fa92aab020cf331765426453b8d951fddd256
MD5 95f380cc7e37e3f2f8ae03bcfd1890a0
SHA1 68d64905ee58bdd3620f8e3739944dfa7de8d977
SHA512 f6a9aca6f963c0df6fe44adf0704a48b8d0b42b55fa529e0fcd02e34ea79a7470441d7910c151d2adc145869cd9a87e2945f9ce59e372f85d8cf1747f2061371
SSDEEP 3072:eyGE9f/m5BhEJ5wj2WEpBIOa7I4cajeBKu4KfN2gkRj4FSbSx+kFyh:DGEBsuJ5wYpBIZ3tNMS3kFyh
TLSH
T10E3406B76EA19CD7C705423AA1F7C6251238EFC04BB247431B12F6351933E9CAF9A646
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Infected

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateSolidBrush DeleteDC DeleteObject Ellipse PlgBlt SelectObject StretchBlt

kernel32

CloseHandle CreateFileW CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WriteFile

msimg32

AlphaBlend

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcpy memset rand signal strlen strncmp vfprintf

shell32

ShellExecuteA

user32

GetDC GetDesktopWindow GetSystemMetrics GetWindowRect InvalidateRect MessageBoxW ReleaseDC

winmm

waveOutClose waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

Name

.text

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ix.exe

advapi32

gdi32

kernel32

msimg32

msvcrt

shell32

user32

winmm

generic