cbf87d58b4955f092b52ce7b4e285ace[.]exe

General

Target
cbf87d58b4955f092b52ce7b4e285ace.exe
Size 400KB
Sample220730-st6rpscbe2
SHA256 5dc322dc39b3492daa70907bf240bcbbcfc388efda53da038960193dc6fde684
MD5 cbf87d58b4955f092b52ce7b4e285ace
SHA1 fb64bfbd96079fea7cb365c07bfae06ecd12694c
SHA512 d9c5b5f0f9ef5fa226e72047acad7841423c344c5f5d4717d8c748f4e4046ad0ae6f230da107014b8f02af5edc484c88b764ba922fd5aa7c875fde010fbf16a6
SSDEEP 6144:WnOOwnrJM8T5nk/sNgbuW9NpOhrblH2KBYt5eGWoOTFqY/kxv2b:icMe5nk/sNgbuKOhrblWui5ehqX
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

cbf87d58b4955f092b52ce7b4e285ace.exe

.exe 400KB

cbf87d58b4955f092b52ce7b4e285ace.exe

IMPHASH dc0513b2e8e866ceee30009dd51093dc
SHA256 5dc322dc39b3492daa70907bf240bcbbcfc388efda53da038960193dc6fde684
MD5 cbf87d58b4955f092b52ce7b4e285ace
SHA1 fb64bfbd96079fea7cb365c07bfae06ecd12694c
SHA512 d9c5b5f0f9ef5fa226e72047acad7841423c344c5f5d4717d8c748f4e4046ad0ae6f230da107014b8f02af5edc484c88b764ba922fd5aa7c875fde010fbf16a6
SSDEEP 6144:WnOOwnrJM8T5nk/sNgbuW9NpOhrblH2KBYt5eGWoOTFqY/kxv2b:icMe5nk/sNgbuKOhrblWui5ehqX
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

45744

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerifyVersionInfoW WriteConsoleInputA EnumDateFormatsW CopyFileExW DnsHostnameToComputerNameW FindNextFileW ReadConsoleOutputCharacterW SetConsoleActiveScreenBuffer LockFile GetProfileSectionA QueryDosDeviceW RequestWakeupLatency GetProcessPriorityBoost GetDriveTypeW GlobalGetAtomNameA DeleteFileW FindNextVolumeMountPointW TlsSetValue SizeofResource WriteConsoleInputW GetConsoleTitleW GetComputerNameExW OpenEventA CallNamedPipeA GetModuleHandleW GetSystemDirectoryA GetDriveTypeA BuildCommDCBAndTimeoutsA GetProcAddress GetModuleHandleA GetShortPathNameA DeleteFileA GetCommandLineW InterlockedIncrement InterlockedExchange CopyFileW CreateActCtxW FormatMessageW EnterCriticalSection FindNextVolumeA CreateIoCompletionPort LoadLibraryA CreateNamedPipeW GetSystemDefaultLangID GetConsoleAliasesLengthA WriteProfileSectionW AddAtomW InterlockedDecrement HeapFree _hwrite InterlockedCompareExchange GetStartupInfoW CreateMailslotW GetCPInfoExW GetSystemWow64DirectoryW GetLastError GetPrivateProfileIntW GetConsoleAliasExesLengthW WaitForDebugEvent SetLastError LoadLibraryW VerifyVersionInfoA VirtualAlloc GetACP lstrcpyA GetConsoleAliasA GetDiskFreeSpaceExA TerminateProcess EnumResourceLanguagesA SetConsoleTextAttribute GlobalGetAtomNameW CreateJobSet MoveFileW lstrcpynA EnumSystemLocalesA GetPrivateProfileSectionNamesW GetFileAttributesW FileTimeToSystemTime GetTapeParameters lstrcmpW SetEvent MoveFileA CreateMutexA FindResourceW GetCommState FormatMessageA CreateFiber GetConsoleFontSize LocalAlloc SetFileShortNameA lstrcpyW HeapLock GetFileAttributesA SetCalendarInfoW GetSystemWindowsDirectoryW GetConsoleAliasesW EnumDateFormatsExW GetComputerNameW GetPrivateProfileStructW _hread LocalFlags OpenWaitableTimerA EnumResourceNamesW CreateFileMappingW SetProcessShutdownParameters lstrcpynW GetFullPathNameW WriteConsoleW FreeUserPhysicalPages WriteConsoleOutputCharacterW OpenJobObjectW CreateFileW SetCurrentDirectoryA GlobalWire GetFileInformationByHandle GetProfileSectionW CommConfigDialogW CreateFileA GetDefaultCommConfigA LocalFree Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection RaiseException RtlUnwind WideCharToMultiByte GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW GetCurrentProcess IsDebuggerPresent TlsGetValue TlsAlloc GetCurrentThreadId TlsFree GetOEMCP GetCPInfo IsValidCodePage SetFilePointer QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate VirtualFree WriteFile HeapAlloc HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode DebugBreak OutputDebugStringA OutputDebugStringW InitializeCriticalSectionAndSpinCount MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP CloseHandle

user32

CharToOemBuffW CharUpperW GetMessageTime LoadMenuA

advapi32

AbortSystemShutdownW

Name

.text

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

172KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.duk

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yoxori

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xihi

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cbf87d58b4955f092b52ce7b4e285ace.exe

kernel32

user32

advapi32