EAX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EAX.exe
Size 2.3MB
Sample261023-stlrjayxaz
SHA256 31352437e557c899fdd2ed62756edd9e25133a0c7faf32942700edb37aec5b37
MD5 1822b4b9522041f239c17baed943ea5e
SHA1 2793c0052bbf0b19f73dec4aa87661ef113d35c7
SHA512 602ccb6f5ecb5d8bbf81db72a1f33e3e767b8f9ffb56db41f670834d16cf06a2fa0f772d971b5f0b1c11beca0c8a0e48a1aad2c9006abbe161ec35752b285eb1
SSDEEP 24576:XhFHlzM0YKgukJR9yNAys8RME7gN6BrKKVgGriTOz5r6ME7gN2m/W:xFH9MVKLAT8Yiz5rVfe
TLSH
T1E8B57382D494B86EC5224B343BFD7C29E0A7BD552D39F98F2D0E7A240BF61E1389851D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EAX.exe

File Explorer

EAX.exe

.exe 2.3MB

EAX.exe

IMPHASH dc1b02aca87dc28765a0f3490fa9aedf
SHA256 31352437e557c899fdd2ed62756edd9e25133a0c7faf32942700edb37aec5b37
MD5 1822b4b9522041f239c17baed943ea5e
SHA1 2793c0052bbf0b19f73dec4aa87661ef113d35c7
SHA512 602ccb6f5ecb5d8bbf81db72a1f33e3e767b8f9ffb56db41f670834d16cf06a2fa0f772d971b5f0b1c11beca0c8a0e48a1aad2c9006abbe161ec35752b285eb1
SSDEEP 24576:XhFHlzM0YKgukJR9yNAys8RME7gN6BrKKVgGriTOz5r6ME7gN2m/W:xFH9MVKLAT8Yiz5rVfe
TLSH
T1E8B57382D494B86EC5224B343BFD7C29E0A7BD552D39F98F2D0E7A240BF61E1389851D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBitmap CreateFontW CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject IntersectClipRect RestoreDC SaveDC SelectObject SetBkMode SetTextColor

kernel32

AddVectoredExceptionHandler CloseHandle CreateDirectoryW CreateFileMappingA CreateFileW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FlsAlloc FlsFree FlsSetValue FormatMessageW FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetTempPathW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf cos cosf exp2 expf floorf fmodf pow powf roundf sin sinf sinh tan

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree GetErrorInfo PropVariantClear

user32

BeginPaint CreateWindowExW DefWindowProcW DestroyCursor DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetCursorPos GetMessageW GetWindowLongPtrW InvalidateRect KillTimer LoadCursorFromFileW LoadCursorW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW ReleaseCapture ScreenToClient SetCapture SetCursor SetFocus SetTimer SetWindowLongPtrW SetWindowPos SetWindowRgn ShowWindow TranslateMessage UnregisterClassW UpdateWindow

winmm

timeBeginPeriod timeEndPeriod

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

oleaut32

SysFreeString SysStringLen

propsys

PropVariantToStringAlloc

Name

.text

Size

338KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

EAX.exe

gdi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

ole32

user32

winmm

bcryptprimitives

api-ms-win-core-synch-l1-2-0

oleaut32

propsys

generic