cdb[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdb.exe
Size

148KB
MD5

fcd6b9dbb1440db4ed8692e2cde35441
SHA1

d78ff1d9377c07a93cdc7d6d92944d4b685c18b7
SHA256

b806eaea373d6add99fd9825a34820eb0779b9045cf71eecd7d070d58b8b6f6d
SHA512

587173c3b5de55fddaab1c085ee4c07a1cd297a89941e2e344f03ad2f08a476ff6b6b59662b350d353127ad4c44c3ceb142b465ceecf23dbf2eb6e249df2602f
SSDEEP

3072:RszW1JdizX+7kmJTf65+05VX2MTmpATeKf81+zZpw5:2zW8zuNy61+zZp6

Score

1^/10

Malware Config

Signatures

Files

cdb.exe
.exe windows x64

3b7fff0e42c10220f4e41d984f61a074

Code Sign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:4a:b1:fb:fd:f1:5b:a0:94:59:0e:14:c7:5f:d3:4f:cc:36:f1:7a:a1:cd:d8:51:2d:d2:34:a7:6e:97:32:e5
Signer

Actual PE Digest

57:4a:b1:fb:fd:f1:5b:a0:94:59:0e:14:c7:5f:d3:4f:cc:36:f1:7a:a1:cd:d8:51:2d:d2:34:a7:6e:97:32:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wgetenv
_vsnprintf_s
free
__iob_func
__CxxFrameHandler3
_spawnlp
realloc
iswprint
??3@YAXPEAX@Z
wcsrchr
toupper
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
_vsnwprintf_s
isspace
_exit
_wcsnicmp
malloc
__C_specific_handler
exit
iswspace
_wcsicmp
calloc
__set_app_type
__wgetmainargs
fgetws
_cexit
_amsg_exit
_XcptFilter
towlower
__setusermatherr
wcsstr
fgetwc
rewind
wcstoul
_initterm
_wfopen
feof
_wcstoi64
wcschr
_fmode
memset
swscanf_s
fgets
?terminate@@YAXXZ
_onexit
_wtoi
__dllonexit
_wcslwr
_purecall
wcscpy_s
fclose
_unlock
_lock
printf
_commode
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlRunOnceExecuteOnce

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
DeleteFileW
GetFileType
ReadFile
CreateFileA

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
InitializeCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
SetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
CreateEventA

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentVariableW
GetCommandLineA
SetStdHandle
ExpandEnvironmentStringsA
GetStdHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ExitProcess
CreateProcessW
GetCurrentThreadId
TerminateProcess
CreateThread
SetThreadPriority
GetCurrentThread
GetCurrentProcess
SetPriorityClass
GetPriorityClass

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-misc-l1-1-0

Sleep
LocalAlloc
FormatMessageW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleW
WriteConsoleW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetVersionExW
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

dbgeng

DebugConnectWide
DebugCreate

kernel32

DelayLoadFailureHook

api-ms-win-core-localregistry-l1-1-0

RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegSetValueExW
RegQueryValueExA

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mrdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b7fff0e42c10220f4e41d984f61a074

Code Sign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

57:4a:b1:fb:fd:f1:5b:a0:94:59:0e:14:c7:5f:d3:4f:cc:36:f1:7a:a1:cd:d8:51:2d:d2:34:a7:6e:97:32:e5Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

dbgeng

kernel32

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l1-1-0

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 8KB - Virtual size: 33KB

.pdata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 64B

.mrdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 2KB

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

57:4a:b1:fb:fd:f1:5b:a0:94:59:0e:14:c7:5f:d3:4f:cc:36:f1:7a:a1:cd:d8:51:2d:d2:34:a7:6e:97:32:e5
Signer

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 8KB - Virtual size: 33KB

.pdata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 64B

.mrdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 2KB