sanbox-killer-federico[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

sanbox-killer-federico.exe
Size

1.3MB
MD5

c278cc5345ba5208076bc539e73ce021
SHA1

9835c54cb756671fef1b0fd56a5ce4a38e54a75d
SHA256

32fa1215cd3210380959f2e11269cae2609f0860674ad96c6f867f0f6c3ee8ea
SHA512

7b097103977f929c2ac3af4cc28e9d27e75feecbee0dd3a4e9436f72f8358db2e0b5ed87f3ba69f4a05279597813e1f89a052bd2ebe46e875d68062ced96977a
SSDEEP

12288:Sbo/6k4Y7rJWOnDN6vuPxosirYAgjuNhwtyCFT9KcxnJDTfO4Tqu6B1Ulmnwm:qo/4Y/UmxegQhwJFwcHDTfO4TqjU6wm

Score

N/A

Malware Config

Signatures

Files

sanbox-killer-federico.exe
.exe windows x64

4cc87a59c5b6e031dcfafef58900a9a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shell32

CommandLineToArgvW
ShellExecuteW

kernel32

CreateFileW
GetDiskFreeSpaceExW
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
InitializeSListHead
RtlVirtualUnwind
SwitchToThread
Sleep
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentDirectoryW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentProcessId
GetProcessIoCounters
GetSystemTimes
ReadProcessMemory
VirtualQueryEx
LocalFree
IsDebuggerPresent
GetProcessTimes
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetStdHandle
GetProcessHeap
GetLastError
WaitForSingleObject
GetLogicalDrives
QueryPerformanceCounter
WakeAllConditionVariable
WakeConditionVariable
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
OpenProcess
GetModuleHandleW
FormatMessageW
ExitProcess
GetFullPathNameW
CreateThread
TlsGetValue
TlsSetValue
GetConsoleMode
WriteConsoleW
SetUnhandledExceptionFilter
GlobalMemoryStatusEx
GetTickCount64
GetDriveTypeW
GetVolumeInformationW
GetProcAddress
GetModuleHandleA
GetSystemInfo
DeviceIoControl
CloseHandle
GetEnvironmentVariableW
QueryPerformanceFrequency

advapi32

OpenProcessToken
GetTokenInformation
RegQueryValueExW
LookupAccountSidW
RegOpenKeyExW
SystemFunction036

user32

GetSystemMetrics

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

ntdll

RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation

pdh

PdhRemoveCounter
PdhGetFormattedCounterValue
PdhCloseQuery
PdhCollectQueryData
PdhAddEnglishCounterW
PdhOpenQueryA

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

ole32

CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoInitializeEx

oleaut32

VariantClear
SysFreeString
SysAllocString

bcrypt

BCryptGenRandom

psapi

GetPerformanceInfo
GetModuleFileNameExW

vcruntime140

__current_exception_context
__current_exception
__CxxFrameHandler3
memcpy
memset
memcmp
memmove
_CxxThrowException
__C_specific_handler

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_crt_atexit
_get_initial_narrow_environment
_exit
_set_app_type
_initialize_narrow_environment
__p___argc
terminate
_configure_narrow_argv
_register_onexit_function
_initialize_onexit_table
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 999KB - Virtual size: 999KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cc87a59c5b6e031dcfafef58900a9a5

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

advapi32

user32

iphlpapi

ntdll

pdh

powrprof

netapi32

secur32

ole32

oleaut32

bcrypt

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 999KB - Virtual size: 999KB

.rdata Size: 251KB - Virtual size: 250KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 103KB - Virtual size: 103KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 999KB - Virtual size: 999KB

.rdata
Size: 251KB - Virtual size: 250KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 103KB - Virtual size: 103KB

.reloc
Size: 3KB - Virtual size: 2KB