BLACKMATRIX[.]exe | Triage™

General

Target
BLACKMATRIX.exe
Size 32.6MB
Sample261102-pwrh1swt5r
SHA256 e6ffbb9e3fe0018d54ce112b91c48ac2ded9707f036c30d88d5a03e95439bff0
MD5 a02e7e1fa6f3d49cd568dac6d067fdca
SHA1 b848982e4b1b10f212c3eb46179e2145d40ee90a
SHA512 91f681b7da24adafcc034afa321bb63f7db6716f9868af6c8db7635f229c7fb7fef8cad8a46f501e32fd45efe21ca2d8f61bee7d3dfe5589b98484a61a52a8ac
SSDEEP 786432:MA1vfMCz/CdtpO/VaxVOp5UugPHzeJ/fN1lSGj:MA1Mw/Yk/yW5HgvzyX9f
TLSH
T1F8773318705009EAD52AA1B59D531907E3663C4237F606FF2BC1A37B09171FAAB7EB07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BLACKMATRIX.exe

File Explorer

BLACKMATRIX.exe

.exe 32.6MB

BLACKMATRIX.exe

IMPHASH d771ea0e1824cb6584f385f3e76a6e0e
SHA256 e6ffbb9e3fe0018d54ce112b91c48ac2ded9707f036c30d88d5a03e95439bff0
MD5 a02e7e1fa6f3d49cd568dac6d067fdca
SHA1 b848982e4b1b10f212c3eb46179e2145d40ee90a
SHA512 91f681b7da24adafcc034afa321bb63f7db6716f9868af6c8db7635f229c7fb7fef8cad8a46f501e32fd45efe21ca2d8f61bee7d3dfe5589b98484a61a52a8ac
SSDEEP 786432:MA1vfMCz/CdtpO/VaxVOp5UugPHzeJ/fN1lSGj:MA1Mw/Yk/yW5HgvzyX9f
TLSH
T1F8773318705009EAD52AA1B59D531907E3663C4237F606FF2BC1A37B09171FAAB7EB07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

FlsSetValue WriteConsoleW HeapReAlloc CreateDirectoryW SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetFullPathNameW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter SetDllDirectoryW LoadLibraryExW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc MultiByteToWideChar HeapFree VirtualProtect LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32.4MB

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BLACKMATRIX.exe

shell32

kernel32

generic