AtomLite[.]exe | Triage™

General

Target
AtomLite.exe
Size 408KB
Sample261104-wp8x2sev3l
SHA256 d46827cc15b7b4bf7a639405096cdaab68a91c9ff2a6a79d41fdcfba4bb54e70
MD5 0f44656a2c26b50ef4e3591bc8100e67
SHA1 158e2f274853189cddebb79621d0365029ffb4bc
SHA512 fb5902ab4bedfc83a5c9801781c981f849b1985c7d40ab3a3c6a274769a23f45d123766351dfa8fbf292e3ac1ea7e9bf90383d179ec0f769126ee0ed87f42087
SSDEEP 3072:7om40zHfMIhWGf3jNwasnjt8Avc0v4QabpwO2yOc0tpJNqHfX1ydfCM4MrA0A6PT:7P42f+03vBQabpwO2yeraHLpAb9P1/
TLSH
T142945955E6A514E9ED27837C8962C935EA72BC560370D6CF13E06EA33E336D04E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AtomLite.exe

File Explorer

AtomLite.exe

.exe 408KB

AtomLite.exe

IMPHASH ec2de925d3f710f98b531d0d2bc85484
SHA256 d46827cc15b7b4bf7a639405096cdaab68a91c9ff2a6a79d41fdcfba4bb54e70
MD5 0f44656a2c26b50ef4e3591bc8100e67
SHA1 158e2f274853189cddebb79621d0365029ffb4bc
SHA512 fb5902ab4bedfc83a5c9801781c981f849b1985c7d40ab3a3c6a274769a23f45d123766351dfa8fbf292e3ac1ea7e9bf90383d179ec0f769126ee0ed87f42087
SSDEEP 3072:7om40zHfMIhWGf3jNwasnjt8Avc0v4QabpwO2yOc0tpJNqHfX1ydfCM4MrA0A6PT:7P42f+03vBQabpwO2yeraHLpAb9P1/
TLSH
T142945955E6A514E9ED27837C8962C935EA72BC560370D6CF13E06EA33E336D04E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

67744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA

kernel32

GetConsoleCP SetEndOfFile WriteConsoleW HeapSize GetProcessHeap GetStdHandle GetFileAttributesW CloseHandle OpenProcess VirtualAllocEx VirtualQueryEx ReadProcessMemory WriteProcessMemory GetModuleFileNameW GetModuleHandleA GetProcAddress SetConsoleMode FlushConsoleInputBuffer K32EnumProcessModules K32GetModuleBaseNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW SetStdHandle RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind IsProcessorFeaturePresent WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree CreateFileW GetConsoleMode ReadConsoleInputW ReadConsoleW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

Name

.text

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AtomLite.exe

wininet

kernel32

generic