Arcana[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Arcana.exe
Size 11.7MB
Sample261110-eham8syxct
SHA256 cb67bf4123318602a77c8e4f64297c1a1a44c0715e2b5e39b3c0518057e2e857
MD5 7cb52aa05db66a6d74aa7c39b10bca2e
SHA1 778bec3ab757a7fa24564608505c1556e36c70ed
SHA512 c879678bd470a7485332ee952d73eb7e9bf8d3b982a9971e4b4f51ddfaaf6f515b4fe4ed5481eb5192ed63d4f26643087ed4ebfed4dfc803ae36c5933f84df33
SSDEEP 196608:SM+LStLE8rjHlDUcYr60MTZ3dpvREMq8H9z02M0S6wC1BHsLZZN3YdZA:SCB/l4pMNnhjHrM04C1BMlZN3YdZ
TLSH
T1EDC69D43F7A290E8C56AC034935A6232FA317C4947357AEB2BE44B253F65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Arcana.exe

File Explorer

Arcana.exe

.exe 11.7MB

Arcana.exe

IMPHASH fae58ef9e2d8f58caceaac1df03eda7b
SHA256 cb67bf4123318602a77c8e4f64297c1a1a44c0715e2b5e39b3c0518057e2e857
MD5 7cb52aa05db66a6d74aa7c39b10bca2e
SHA1 778bec3ab757a7fa24564608505c1556e36c70ed
SHA512 c879678bd470a7485332ee952d73eb7e9bf8d3b982a9971e4b4f51ddfaaf6f515b4fe4ed5481eb5192ed63d4f26643087ed4ebfed4dfc803ae36c5933f84df33
SSDEEP 196608:SM+LStLE8rjHlDUcYr60MTZ3dpvREMq8H9z02M0S6wC1BHsLZZN3YdZA:SCB/l4pMNnhjHrM04C1BMlZN3YdZ
TLSH
T1EDC69D43F7A290E8C56AC034935A6232FA317C4947357AEB2BE44B253F65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6253760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Arcana.pdb

ntdll

RtlGetVersion NtWriteFile NtDeviceIoControlFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtCancelIoFileEx

user32

PostMessageW SetWindowLongW GetClientRect GetWindowLongPtrW GetCursorPos SendMessageW GetSystemMenu GetWindowTextW GetWindowTextLengthW RegisterWindowMessageA SetWindowTextW IsProcessDPIAware TrackPopupMenu AppendMenuW InsertMenuW CreatePopupMenu CreateMenu ShowCursor DrawIconEx GetDC SetMenuItemInfoW EnableMenuItem VkKeyScanW CheckMenuItem DrawTextW ReleaseDC GetWindowDC RegisterRawInputDevices RedrawWindow IsWindowVisible IsIconic MonitorFromWindow EnableWindow IsWindowEnabled OffsetRect MapWindowPoints GetMenuBarInfo GetMessageW TranslateMessage GetClipCursor ShowWindow ClipCursor PostQuitMessage GetKeyboardState GetKeyState MapVirtualKeyExW GetKeyboardLayout CreateAcceleratorTableW SystemParametersInfoA DestroyAcceleratorTable DestroyMenu RemoveMenu RegisterHotKey ToUnicodeEx GetMenu SetPropW AdjustWindowRect keybd_event GetLastInputInfo FindWindowExW CreateIcon GetForegroundWindow FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetParent GetWindowRect LockWorkStation EnumChildWindows DispatchMessageA GetMessageA SetWindowRgn DrawMenuBar SetMenu RegisterClassW GetMenuItemInfoW SendMessageTimeoutW AllowSetForegroundWindow GetWindowThreadProcessId FindWindowW UnregisterHotKey TranslateAcceleratorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW EnumDisplayMonitors DestroyIcon GetIconInfo LoadImageW GetMonitorInfoW SystemParametersInfoW SetCursor LoadCursorW GetWindow MonitorFromRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture ReleaseCapture FillRect ClientToScreen GetWindowLongW ScreenToClient SetFocus GetUpdateRect ValidateRect GetRawInputData SetWindowDisplayAffinity SetParent GetAsyncKeyState RegisterTouchWindow GetSystemMetrics MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW DefWindowProcW SetWindowLongPtrW DestroyWindow MonitorFromPoint SendInput MapVirtualKeyW SetForegroundWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW DispatchMessageW

kernel32

GetTickCount GetCurrentProcess DuplicateHandle GetExitCodeProcess GetCurrentThread SetThreadStackGuarantee RtlPcToFileHeader RaiseException HeapReAlloc GetTimeZoneInformationForYear WakeAllConditionVariable SwitchToThread AcquireSRWLockExclusive ReleaseSRWLockExclusive lstrlenW GetCurrentThreadId PostQueuedCompletionStatus CreateIoCompletionPort FindNextFileW MoveFileExW CopyFileExW QueryPerformanceCounter AddVectoredExceptionHandler GetFinalPathNameByHandleW GetTempPathW SleepConditionVariableSRW GetFileAttributesW CreateProcessW RtlCaptureContext FreeEnvironmentStringsW LCIDToLocaleName GetUserDefaultUILanguage GetEnvironmentStringsW RtlVirtualUnwind QueryPerformanceFrequency GetOverlappedResult CancelIo CreateEventW CreateDirectoryW GetSystemTimeAsFileTime GetFileInformationByHandleEx GetModuleHandleW LoadLibraryW GetModuleHandleA GetSystemInfo GetModuleFileNameW GetFileInformationByHandle WaitForSingleObject ExitProcess RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx GetCurrentProcessId WideCharToMultiByte FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree HeapAlloc FlsGetValue SleepEx SetHandleInformation CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW WaitForMultipleObjects SetFileInformationByHandle SetWaitableTimer SetFileTime FindFirstFileExW GetFullPathNameW WriteFileEx ReadFileEx GetEnvironmentVariableW WriteConsoleW EncodePointer GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA GetCurrentDirectoryW CreateFileW CreateProcessA DeleteFileW InitializeSListHead SetUnhandledExceptionFilter GetCommandLineW RtlUnwindEx LoadLibraryA GetQueuedCompletionStatusEx GetLastError GetProcAddress FindClose ReleaseMutex CloseHandle LocalFree HeapFree GetSystemTimePreciseAsFileTime ReadFile LoadLibraryExA GetProcessHeap CreateWaitableTimerExW SetEnvironmentVariableW CreateMutexW OutputDebugStringA OutputDebugStringW LoadLibraryExW InitializeCriticalSectionEx FreeLibrary CreateThread Sleep DeleteCriticalSection

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shell32

DragQueryFileW ShellExecuteW SHAppBarMessage SHGetStockIconInfo CommandLineToArgvW DragFinish SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

gdi32

DeleteDC CreateDIBSection SetBkMode GetDIBits CombineRgn SetTextColor CreateCompatibleDC DeleteObject BitBlt GetDeviceCaps CreateRectRgn CreateSolidBrush SelectObject

ole32

OleInitialize CoCreateInstance CoInitializeEx RegisterDragDrop RevokeDragDrop CoUninitialize

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

shlwapi

SHCreateMemStream

advapi32

RegCloseKey RegQueryValueExW RegGetValueW SystemFunction036 RegOpenKeyExW EventRegister EventUnregister EventWriteTransfer EventSetInformation

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

crypt32

CertOpenStore CertFreeCertificateContext CertCloseStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateStore CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

ws2_32

connect recv WSARecv getpeername freeaddrinfo getaddrinfo send WSASend WSADuplicateSocketW setsockopt ioctlsocket WSAStartup getsockopt closesocket WSASocketW WSAGetLastError getsockname select

secur32

InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage DeleteSecurityContext QueryContextAttributesW

api-ms-win-crt-math-l1-1-0

pow ceil __setusermatherr expf exp trunc floor round roundf

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi64 _wtoi _ultow_s

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _cexit _c_exit _initterm _register_thread_local_exe_atexit_callback abort _get_initial_narrow_environment __p___argc _initialize_narrow_environment _configure_narrow_argv terminate _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _seh_filter_exe __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc calloc