Astralys[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Astralys.exe
Size 1.6MB
Sample261024-jrl5vaav9j
SHA256 3f7f8fc969ef72841b5852418fa558133374b3d04712d9d2de7c8d769989146b
MD5 2f4f5db66b602d48b642d6a58e00321a
SHA1 d5c744367bb14d9cf30bb2ce44696cf06f741d14
SHA512 9f85a9f45559c623b5575f5ad03bf5523230270afea07dfb8e5bcb935cf4848736687dc1d7b920f22357e9d7823ced704e6e3f6c2bda42dc9f0741457708629b
SSDEEP 24576:YetNsLso60OegX7AoKCnJO82rYudrgZRMxMmABlNG4BcD/rjBvuEc6AcRsGIbPkt:Y5K0ErvDnJSsudkuXEEXePkSDWn
TLSH
T17875AF03E3B1419CC21F99388212DB1BBA3778A4932097C7BBC815954B9B6F86F6F5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Astralys.exe

File Explorer

Astralys.exe

.exe 1.6MB

Astralys.exe

IMPHASH 56064754d7b3037d67e2c3202b1f56e1
SHA256 3f7f8fc969ef72841b5852418fa558133374b3d04712d9d2de7c8d769989146b
MD5 2f4f5db66b602d48b642d6a58e00321a
SHA1 d5c744367bb14d9cf30bb2ce44696cf06f741d14
SHA512 9f85a9f45559c623b5575f5ad03bf5523230270afea07dfb8e5bcb935cf4848736687dc1d7b920f22357e9d7823ced704e6e3f6c2bda42dc9f0741457708629b
SSDEEP 24576:YetNsLso60OegX7AoKCnJO82rYudrgZRMxMmABlNG4BcD/rjBvuEc6AcRsGIbPkt:Y5K0ErvDnJSsudkuXEEXePkSDWn
TLSH
T17875AF03E3B1419CC21F99388212DB1BBA3778A4932097C7BBC815954B9B6F86F6F5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

267248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\H3\Downloads\cheat minecraft + loader\loader_clean\x64\Release\Astralys.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

DeleteFileA LoadResource GetTempFileNameA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter WriteProcessMemory FindResourceA GetLastError CreateToolhelp32Snapshot GetFileAttributesA Process32NextW Process32FirstW CloseHandle VirtualAllocEx CreateRemoteThread VirtualFreeEx LoadLibraryW SizeofResource GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LockResource GetTempPathA Sleep OpenProcess GetVolumeInformationA GetModuleHandleW WaitForSingleObject GetCurrentProcessId

user32

GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes MoveWindow PostQuitMessage UpdateWindow GetWindowThreadProcessId FindWindowA GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetClipboardData TranslateMessage GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture SetCapture SetCursor GetClientRect IsWindowUnicode

msvcp140

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_alloc@std@@YAXXZ

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSendRequest WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __current_exception_context __C_specific_handler memset __std_exception_destroy __std_exception_copy __std_terminate strstr memchr memcmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

fgetc fwrite fgetpos __stdio_common_vsscanf fclose _set_fmode __stdio_common_vsprintf _wfopen setvbuf fseek __p__commode __acrt_iob_func fflush ftell fputc _get_stream_buffer_pointers _fseeki64 fread __stdio_common_vsprintf_s fsetpos ungetc __stdio_common_vfprintf

api-ms-win-crt-time-l1-1-0

_gmtime64_s strftime _time64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-string-l1-1-0

strcmp strlen wcslen strncpy strncmp _stricmp

api-ms-win-crt-runtime-l1-1-0

_exit _initterm_e _initterm _get_narrow_winmain_command_line _c_exit _register_thread_local_exe_atexit_callback exit _set_app_type _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe

api-ms-win-crt-math-l1-1-0

sinf sqrtf acosf powf fmodf cosf ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale