IMMORTAL[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IMMORTAL.exe
Size 382KB
Sample261029-151c3ace96
SHA256 0b6a88afb192a66a82f76e857e101f221cbdb53ca5571efa6e225df8c1ac9273
MD5 a44daf3afc01a0b6fdd7c8f4db84a36c
SHA1 54c22a1b1395678125cba11fdab9d61e893805b9
SHA512 0a559d119eba4560339e78c069e3c94a20caa7702eb2e957ac3f447a0d47e6ac84d543b8a76d542a91eb10525e5a04c9c762bc69b2c4657f8883004fa65f676d
SSDEEP 6144:NVbriEWbJZlkfLvKmLak/0NssDa+tncHU1lirDfV0jmLqk/0NssDa+tncHU1li:rAqftsDaKncHuc0SsDaKncHu
TLSH
T13784AEA1B6D02CCAF671527806E5E122B33DF9E047238F0B55606A361F53F813ED9A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IMMORTAL.exe

File Explorer

IMMORTAL.exe

.exe 382KB

IMMORTAL.exe

IMPHASH a23f73fe401ce26473abdf12b55835e2
SHA256 0b6a88afb192a66a82f76e857e101f221cbdb53ca5571efa6e225df8c1ac9273
MD5 a44daf3afc01a0b6fdd7c8f4db84a36c
SHA1 54c22a1b1395678125cba11fdab9d61e893805b9
SHA512 0a559d119eba4560339e78c069e3c94a20caa7702eb2e957ac3f447a0d47e6ac84d543b8a76d542a91eb10525e5a04c9c762bc69b2c4657f8883004fa65f676d
SSDEEP 6144:NVbriEWbJZlkfLvKmLak/0NssDa+tncHU1lirDfV0jmLqk/0NssDa+tncHU1li:rAqftsDaKncHuc0SsDaKncHu
TLSH
T13784AEA1B6D02CCAF671527806E5E122B33DF9E047238F0B55606A361F53F813ED9A97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetDIBits GetStockObject GetTextExtentPoint32W LineTo MoveToEx Polygon Rectangle RoundRect SelectObject SetBkMode SetStretchBltMode SetTextColor StretchBlt

kernel32

CloseHandle CreateFileW DeleteCriticalSection DeleteFileW EnterCriticalSection FreeLibrary GetEnvironmentVariableW GetFileAttributesW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetProcAddress GetStartupInfoA GetTickCount InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA MultiByteToWideChar QueryPerformanceCounter SetComputerNameExW SetFilePointer SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr cos floor fmod sin

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy strstr wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vswprintf _wfopen fclose fflush fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_wcsicmp _wcsnicmp memset strlen strncmp wcscpy wcslen wcsncpy

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetDC GetKeyState GetMessageW GetMonitorInfoW GetSystemMetrics GetWindowLongW GetWindowRect InflateRect InvalidateRect LoadCursorA LoadCursorW LoadIconW LoadImageW MonitorFromWindow OffsetRect PostMessageW PostQuitMessage RedrawWindow RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetCursor SetRect SetWindowLongW SetWindowPos ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

512B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

512B

Virtual Size

330B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc2

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IMMORTAL.exe

advapi32

comctl32

gdi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic