azimuth[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
azimuth.exe
Size 3.4MB
Sample261102-p6vnesct3l
SHA256 78a5f635b3241918707b5acddeaa96bd59ccb3819490e9218ee152497ca73639
MD5 4a56f02639d0223054108559a98043d8
SHA1 0c9533c7b060a665eea6c70b6643ee2d36f6cfd7
SHA512 41b129f52053501d89da12e5ed905a58c77c4fcecac6c53f69d6614a482ce88d9035bff28f7c2a3f04db57fd83d71fd5e2cb9d480fdf5ef907ca1db776e817cc
SSDEEP 49152:4U+ATWgaavnCRReeo/3c/GqCil55TxYwbro/6twpz9Dd2rMmyiJQ0VR9i/N:4UaGCRA/3cXTOWrXyiJQz
TLSH
T106F56C27669801FCE077C17DCF879A43E7B2744943706AEF069086A61F67AE44E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
azimuth.exe

File Explorer

azimuth.exe

.exe 3.4MB

azimuth.exe

IMPHASH c06b33768dea2e067265bfc52273cc9b
SHA256 78a5f635b3241918707b5acddeaa96bd59ccb3819490e9218ee152497ca73639
MD5 4a56f02639d0223054108559a98043d8
SHA1 0c9533c7b060a665eea6c70b6643ee2d36f6cfd7
SHA512 41b129f52053501d89da12e5ed905a58c77c4fcecac6c53f69d6614a482ce88d9035bff28f7c2a3f04db57fd83d71fd5e2cb9d480fdf5ef907ca1db776e817cc
SSDEEP 49152:4U+ATWgaavnCRReeo/3c/GqCil55TxYwbro/6twpz9Dd2rMmyiJQ0VR9i/N:4UaGCRA/3cXTOWrXyiJQz
TLSH
T106F56C27669801FCE077C17DCF879A43E7B2744943706AEF069086A61F67AE44E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2321084

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

azimuth.pdb

user32

SetForegroundWindow GetClientRect TranslateMessage PeekMessageW DispatchMessageW IsWindow ShowWindow MsgWaitForMultipleObjects GetWindow PostMessageW ReleaseDC PtInRect DrawTextW MonitorFromPoint DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes IntersectRect QueryDisplayConfig EqualRect GetWindowRect GetWindowThreadProcessId EnableWindow LoadImageW SystemParametersInfoW SetCursor LoadCursorW SetFocus IsWindowEnabled GetCursorPos MessageBoxW GetDC GetForegroundWindow CharUpperBuffW SetTimer KillTimer MsgWaitForMultipleObjectsEx UnregisterClassW ClientToScreen GetMessageW DefWindowProcW AdjustWindowRectEx GetKeyState GetMonitorInfoW IsWindowVisible SetWindowPos MonitorFromWindow DestroyWindow SetWindowLongPtrW CreateWindowExW ScreenToClient GetSystemMetrics GetWindowLongPtrW RegisterClassExW WindowFromPoint GetWindowPlacement GetAsyncKeyState SetWindowPlacement

gdi32

SetBrushOrgEx BitBlt CreateCompatibleBitmap SaveDC SelectObject CreateDIBSection CreateCompatibleDC GdiAlphaBlend GdiFlush StretchDIBits CreateFontW DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode SetBkColor SetStretchBltMode RestoreDC DeleteObject ExtTextOutW IntersectClipRect

shell32

CommandLineToArgvW SHCreateItemFromParsingName

ole32

CoCreateInstance CoUninitialize CoGetApartmentType CoIncrementMTAUsage CoTaskMemAlloc CoInitializeEx CoTaskMemFree

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d3d12

ord101 D3D12SerializeRootSignature ord102

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

d3dcompiler_47

D3DCompile

bcrypt

BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptOpenAlgorithmProvider

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

winmm

timeBeginPeriod

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess GetStdHandle SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo GetStringTypeW WriteConsoleW EncodePointer DeleteCriticalSection LeaveCriticalSection LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize GetConsoleOutputCP GetConsoleMode IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetSystemTimeAsFileTime InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete AreFileApisANSI SetFileInformationByHandle FindFirstFileW LCMapStringEx GetFullPathNameW GetNativeSystemInfo GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable FormatMessageA GetProcessAffinityMask TrySubmitThreadpoolCallback AddVectoredExceptionHandler GetWriteWatch GetCommandLineW OutputDebugStringA IsDebuggerPresent SetThreadDescription GetLocaleInfoEx CompareStringOrdinal GetTickCount64 GetCurrentThread WaitForSingleObject ReadFile GetFileSizeEx RtlCaptureContext GetCurrentProcess WriteFile TerminateProcess GetFinalPathNameByHandleW GetEnvironmentVariableW CreateFileW GetCurrentThreadId GetThreadDescription RtlCaptureStackBackTrace CreateEventW Sleep GetLastError SetEvent CloseHandle RaiseException CreateThread GetProcAddress LocalFree GetCurrentProcessId GetModuleHandleW OpenThread LoadLibraryExW SetUnhandledExceptionFilter VirtualProtect SetLastError VirtualFree VirtualAlloc GetUserDefaultLocaleName FlushInstructionCache SetWaitableTimer ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency CreateWaitableTimerExW QueryPerformanceCounter SetEnvironmentVariableW GlobalMemoryStatusEx VirtualQuery FindFirstFileExW FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW MultiByteToWideChar DeleteFileW MoveFileExW WideCharToMultiByte SetDefaultDllDirectories GetModuleFileNameW GetCurrentPackageFullName WritePrivateProfileStringW GetUserPreferredUILanguages GetPrivateProfileStringW CreateDirectoryW GetSystemTime SizeofResource QueryDosDeviceW GetSystemDirectoryW LockResource LoadResource FindResourceW K32EnumProcessModules K32GetMappedFileNameW GetSystemWindowsDirectoryW WaitForThreadpoolTimerCallbacks DuplicateHandle CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer GetFileAttributesExW SubmitThreadpoolWork CreateThreadpoolWork GetModuleHandleExW FreeLibrary RtlAddFunctionTable RtlDeleteFunctionTable GetProcessId GetThreadId GetQueuedCompletionStatus UnmapViewOfFile ReleaseSRWLockShared GetOverlappedResultEx AcquireSRWLockShared CreateFileMappingW TryEnterCriticalSection EnterCriticalSection GetProcessIdOfThread SwitchToThread SleepEx SetThreadPriority HeapFree HeapAlloc GetProcessHeap DecodePointer RtlPcToFileHeader FormatMessageW GetFileInformationByHandleEx SetFilePointer SetEndOfFile GetACP GetDiskFreeSpaceExW SetFilePointerEx CopyFileW FlushFileBuffers GetSystemTimePreciseAsFileTime TryAcquireSRWLockExclusive FlushProcessWriteBuffers WaitForMultipleObjects