Palais[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Palais.exe
Size 32.4MB
Sample261102-tdf2sabs9v
SHA256 0ef2aa37565654a041711c7fd2dfee7b1da3d05c18a3b587649d39348b90ab27
MD5 8be39e578d22a839877339876817bade
SHA1 d4be8d35469a548f9ff33bc119b5a48a93723b02
SHA512 6c1098a8278b4dac65710a0746266a198992110b8664cba7de3e9b768d1c5858593bffdb33a50dd3b2f29da0f86af72cf9e96a02d179c6c508f53672d7d1845d
SSDEEP 786432:1Mrgm58MhtKpFni4eKTWlrX4DIOzCIX8tj5C1a:1Mrgm5/ITn1biX4DfZ8m1
TLSH
T18E77020A738C4EE3F356D634C9565732D6B0BC394638DA0F1AC9DA061F2F9518D2BE62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Palais.exe

File Explorer

Palais.exe

.exe 32.4MB

Palais.exe

IMPHASH cbf640ba1176ef1710de72a76144188f
SHA256 0ef2aa37565654a041711c7fd2dfee7b1da3d05c18a3b587649d39348b90ab27
MD5 8be39e578d22a839877339876817bade
SHA1 d4be8d35469a548f9ff33bc119b5a48a93723b02
SHA512 6c1098a8278b4dac65710a0746266a198992110b8664cba7de3e9b768d1c5858593bffdb33a50dd3b2f29da0f86af72cf9e96a02d179c6c508f53672d7d1845d
SSDEEP 786432:1Mrgm58MhtKpFni4eKTWlrX4DIOzCIX8tj5C1a:1Mrgm5/ITn1biX4DfZ8m1
TLSH
T18E77020A738C4EE3F356D634C9565732D6B0BC394638DA0F1AC9DA061F2F9518D2BE62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3624400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileW CreateRemoteThread CreateThread CreateThreadpoolIo CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeLibrary GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDefaultLCID GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GlobalAlloc GlobalFree InitializeConditionVariable InitializeCriticalSection K32EnumProcesses LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReadProcessMemory RemoveDirectoryW ResetEvent ResumeThread SetConsoleCtrlHandler SetEvent SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory RaiseException AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread GetCurrentThreadId SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext FlushInstructionCache GetSystemTimeAsFileTime VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoUninitialize CoTaskMemFree CoCreateGuid CoInitializeEx CoGetApartmentType CoWaitForMultipleHandles CoTaskMemAlloc

oleaut32

OleCreatePictureIndirect

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc calloc _aligned_malloc _aligned_free _set_new_mode

api-ms-win-crt-math-l1-1-0

expf floorf fmaf fmodf coshf log10f log2f logf cosf modf modff pow powf sinf sinhf sqrt sqrtf tanf tanhf log asinf acosf ceilf asinhf __setusermatherr atan2f ceil atanf cbrtf atanhf acoshf

api-ms-win-crt-string-l1-1-0

strlen _stricmp strcmp strcpy_s strcpy

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnprintf_s _set_fmode

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback terminate _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit abort _seh_filter_exe _set_app_type _cexit _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___wargv __p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale