citron_v2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
citron_v2.exe
Size 17.9MB
Sample261113-b136qaev8w
SHA256 f8d0e181e0becdc4dcc43c9aa77e1f8b1b169162d5be4660e6d85ed29ce89bef
MD5 338a0da3b1066b67c3b5f91065ef385b
SHA1 c56c4216c8263516f75faccf31dfaeaac3231274
SHA512 e0fc5b26cd7094611a0434b1e8f1226d362a0c42fd83bad73ff8959cc3ee39681efdf613b177f3ebb70e231ed84dc48d3e810fa24519c85ec56653da109d44f6
SSDEEP 98304:h++p2a+dkOnM/biXz1msKgeMtMtJRPYLu7xk8BW/LOQm4Tz2O2O8+HPvbitpT9QB:APzkbMplCRQL+BW/LOk0bCipe
TLSH
T146176B15BA9A95ADC06AC470834A86336A3178CB0B39B9FF45C456393F79EF05F38718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
citron_v2.exe

File Explorer

citron_v2.exe

.exe 17.9MB

citron_v2.exe

IMPHASH ec77d7e2709b6e1de24fe6f31d9cfac0
SHA256 f8d0e181e0becdc4dcc43c9aa77e1f8b1b169162d5be4660e6d85ed29ce89bef
MD5 338a0da3b1066b67c3b5f91065ef385b
SHA1 c56c4216c8263516f75faccf31dfaeaac3231274
SHA512 e0fc5b26cd7094611a0434b1e8f1226d362a0c42fd83bad73ff8959cc3ee39681efdf613b177f3ebb70e231ed84dc48d3e810fa24519c85ec56653da109d44f6
SSDEEP 98304:h++p2a+dkOnM/biXz1msKgeMtMtJRPYLu7xk8BW/LOQm4Tz2O2O8+HPvbitpT9QB:APzkbMplCRQL+BW/LOk0bCipe
TLSH
T146176B15BA9A95ADC06AC470834A86336A3178CB0B39B9FF45C456393F79EF05F38718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11579712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

citron_v2.pdb

user32

GetClassNameW CloseTouchInputHandle GetTouchInputInfo GetWindowTextW RegisterTouchWindow CloseClipboard RegisterClipboardFormatW GetClipboardData SetClipboardData CallNextHookEx IsWindowVisible GetWindowLongW EmptyClipboard IsClipboardFormatAvailable OpenClipboard SetWindowLongW SetWindowDisplayAffinity CreateWindowExA DefWindowProcA RegisterClassExA GetAsyncKeyState GetClassInfoExA ToUnicodeEx GetKeyboardLayout GetKeyState GetKeyboardState MapVirtualKeyExW TrackMouseEvent MonitorFromRect ScreenToClient ValidateRect UnhookWindowsHookEx GetWindowTextLengthW SetForegroundWindow AdjustWindowRectEx GetSystemMenu ShowCursor ClipCursor GetClipCursor IsIconic DestroyCursor GetRawInputData RegisterClassExW MsgWaitForMultipleObjectsEx MapVirtualKeyW DestroyWindow SendMessageW SetCapture RegisterRawInputDevices ShowWindow EnumDisplayMonitors MonitorFromPoint ReleaseCapture RegisterClassW GetMonitorInfoW DispatchMessageW CreateWindowExW ChangeWindowMessageFilterEx TrackPopupMenu SendInput TranslateMessage GetMessageW PostMessageW SetWindowsHookExW EnumWindows GetWindowThreadProcessId RemovePropW CallWindowProcW GetForegroundWindow SetPropW GetSystemMetrics GetCursorInfo SetWindowTextW FindWindowW PostThreadMessageW SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx SetCursor LoadCursorW SetCursorPos InvalidateRgn SetWindowPos RedrawWindow GetPropW CreateIconFromResourceEx PeekMessageW GetWindowRect GetClientRect GetActiveWindow SystemParametersInfoA ClientToScreen GetMenu EnableMenuItem ReleaseDC IsProcessDPIAware GetDC MonitorFromWindow RegisterWindowMessageA SetTimer KillTimer GetCursorPos DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW CreateIcon DestroyIcon

kernel32

GetCurrentProcessId GetCurrentThreadId OpenProcess QueryFullProcessImageNameW RtlVirtualUnwind CreateEventA GetCurrentThread SetThreadPriority WaitForMultipleObjectsEx SetEvent GetSystemTimeAsFileTime SetUnhandledExceptionFilter CreateWaitableTimerExW SetWaitableTimer IsThreadAFiber FlsSetValue FlsAlloc FlsFree GetFileAttributesW CreateMutexW WriteFileEx LoadLibraryA GetConsoleOutputCP GetConsoleMode WriteConsoleW GetEnvironmentVariableW DeleteFileW RtlCaptureContext GetModuleFileNameW HeapReAlloc CreateThread ReleaseMutex CreateMutexA WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW WaitForSingleObject AddVectoredExceptionHandler RemoveVectoredExceptionHandler DuplicateHandle GetCurrentProcess GetStdHandle CreateFileW SetFileInformationByHandle MoveFileExW QueryPerformanceCounter QueryPerformanceFrequency RtlLookupFunctionEntry SetLastError LocaleNameToLCID GetModuleHandleW GetModuleHandleA GetCurrentDirectoryW GetSystemTimePreciseAsFileTime GetFullPathNameW SetThreadStackGuarantee FreeEnvironmentStringsW CompareStringOrdinal SetFileTime WideCharToMultiByte GlobalFree GetFileInformationByHandle SetThreadErrorMode InitializeSListHead FreeLibrary LoadLibraryExW GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GlobalSize GetEnvironmentStringsW GlobalUnlock GlobalAlloc GetProcAddress SetFilePointerEx GlobalLock CreateDirectoryW LoadLibraryExA GetProcessHeap HeapFree HeapAlloc CloseHandle lstrlenW MultiByteToWideChar FormatMessageW SleepEx ReadFileEx Sleep GetLastError GetModuleHandleExW SetHandleInformation

advapi32

RegDeleteValueW RegSetValueExW RegCreateKeyExW RevertToSelf ImpersonateAnonymousToken RegCloseKey SystemFunction036

ole32

CoInitializeEx CoCreateInstance RevokeDragDrop PropVariantClear RegisterDragDrop OleInitialize CoUninitialize

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree

shell32

DragFinish DragQueryFileW Shell_NotifyIconGetRect SHGetKnownFolderPath Shell_NotifyIconW SHCreateItemFromParsingName

gdi32

CreateRectRgn DeleteObject GetDeviceCaps DescribePixelFormat SetPixelFormat GetPixelFormat ChoosePixelFormat SwapBuffers

shlwapi

AssocQueryStringW

uiautomationcore

UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaLookupId

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

winmm

timeBeginPeriod

oleaut32

SysAllocStringLen SysFreeString SetErrorInfo SafeArrayCreateVector SysStringLen SafeArrayPutElement GetErrorInfo VariantClear

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

opengl32

wglMakeCurrent wglGetProcAddress wglDeleteContext wglCreateContext wglGetCurrentContext

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

ws2_32

WSAStartup WSACleanup freeaddrinfo closesocket listen bind getaddrinfo getsockname WSAGetLastError setsockopt getsockopt ioctlsocket recv send getpeername WSARecv WSASend WSADuplicateSocketW accept connect WSASocketW select

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile

vcruntime140

__current_exception_context memcmp __current_exception memcpy __CxxFrameHandler3 __C_specific_handler memmove _CxxThrowException memset

api-ms-win-crt-math-l1-1-0

pow log atan2f round cos tan sin roundf __setusermatherr fmod ceil cbrtf _hypotf fmaf logf exp2 exp2f floor truncf _hypot log2 cosf exp log1p log1pf fma acosh atan2 cbrt acoshf sinf atan acos atanf asin asinf tanh tanhf tanf sinh sinhf cosh coshf fmodf acosf asinhf asinh log2f ceilf trunc floorf expf powf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_c_exit strerror terminate _crt_atexit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback exit _exit __p___argc _initialize_onexit_table __p___argv _cexit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free