onyx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
onyx.exe
Size 452KB
Sample261102-rmffhaaw91
SHA256 7c43cca0811ff5d6f7a8336b63627bd5dc239bae46ba6d4f22ac92d751bc7a5f
MD5 2a4fc5263ecf8c8ef12c35f86117b3b1
SHA1 1166de22d48acb88276a65206e12de49474c54d5
SHA512 e4afd724534f7fa0963c899dac335087cc150a9c79501694f3e9f82586f428b34de56369a218bdb0a7ea9b6d02fbc6e0605ef53c8972460b873829c4db9f6d45
SSDEEP 12288:iSMXDIURteKn5OL5WmXBa5q94OPHWhHx5nudTkOf8Z0ZcvSYd6Q6CFJgP8:9FU9n5OLfXBa56P2PhIU
TLSH
T171A47C15E6E401FDE277D278C9539806EA76784A0730AADF03D095B61F276D48F3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
onyx.exe

File Explorer

onyx.exe

.exe 452KB

onyx.exe

IMPHASH e9fa44c88a06e9f349e68b6e94799890
SHA256 7c43cca0811ff5d6f7a8336b63627bd5dc239bae46ba6d4f22ac92d751bc7a5f
MD5 2a4fc5263ecf8c8ef12c35f86117b3b1
SHA1 1166de22d48acb88276a65206e12de49474c54d5
SHA512 e4afd724534f7fa0963c899dac335087cc150a9c79501694f3e9f82586f428b34de56369a218bdb0a7ea9b6d02fbc6e0605ef53c8972460b873829c4db9f6d45
SSDEEP 12288:iSMXDIURteKn5OL5WmXBa5q94OPHWhHx5nudTkOf8Z0ZcvSYd6Q6CFJgP8:9FU9n5OLfXBa56P2PhIU
TLSH
T171A47C15E6E401FDE277D278C9539806EA76784A0730AADF03D095B61F276D48F3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

187856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW ShowWindow TranslateMessage IsZoomed GetKeyState SetTimer KillTimer GetSystemMetrics UpdateWindow DispatchMessageW SetWindowPos BeginPaint EndPaint GetClientRect GetWindowRect AdjustWindowRectEx SetCursor GetCursorPos ScreenToClient FindWindowW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetProcessDpiAwarenessContext GetDpiForWindow GetMonitorInfoW MonitorFromWindow SystemParametersInfoW LoadIconW LoadCursorW GetMessageW

gdi32

SelectObject DeleteObject DeleteDC CreateCompatibleDC GetStockObject CreateDIBSection

d2d1

ord1

dwrite

DWriteCreateFactory

ole32

CoInitializeEx CoUninitialize CoCreateInstance CreateStreamOnHGlobal

shell32

CommandLineToArgvW

dwmapi

DwmExtendFrameIntoClientArea

comdlg32

GetOpenFileNameW

winhttp

WinHttpConnect WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpOpen WinHttpReadData WinHttpCloseHandle

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetProcessHeap HeapReAlloc LCMapStringW WriteConsoleW VirtualProtect ReadConsoleW ReadFile SetFilePointerEx SetStdHandle GetStringTypeW CreateFileW HeapSize GetFileSizeEx GetConsoleMode SetEndOfFile GetConsoleOutputCP FlushFileBuffers GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind FreeLibrary RtlCaptureContext IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx EncodePointer FlsFree GetCommandLineW Sleep GetModuleFileNameW MulDiv CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread GetLocalTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte DeleteFileW GetFileAttributesW GetLastError VirtualQuery RtlUnwind GetProcAddress LoadLibraryExW LocalFree FormatMessageW CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FlsSetValue RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue

Name

.text

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

onyx.exe

user32

gdi32

d2d1

dwrite

ole32

shell32

dwmapi

comdlg32

winhttp

kernel32

generic