d:\Kubao\KubaoClient\Bin\KubaoInstall_IM\Release\KubaoInstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8c5cb03bdca42f48bfcd8ed9a2f22cda.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8c5cb03bdca42f48bfcd8ed9a2f22cda.exe
Resource
win10v2004-20231215-en
General
-
Target
8c5cb03bdca42f48bfcd8ed9a2f22cda
-
Size
124KB
-
MD5
8c5cb03bdca42f48bfcd8ed9a2f22cda
-
SHA1
ba28ee9dd2481106bc54221690c1fe9c00b09635
-
SHA256
d8cf6fbb8376d08527258ed3d32377e4fd00c7bffff78ce0879a4c3c046291bd
-
SHA512
c2a37556b59cf428bdd6b21d987527ea2344c098018d0b9f364c169b369165157fb612520142a3fa3e286091b409d9946be4ea43d49070aeab77292e88ad8837
-
SSDEEP
3072:K+FXeUZue4cFzi7rzjetb9t1xlE24klO2ge:KCB4Hnzatb9tPlMT25
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c5cb03bdca42f48bfcd8ed9a2f22cda
Files
-
8c5cb03bdca42f48bfcd8ed9a2f22cda.exe windows:4 windows x86 arch:x86
00e08d67b7635fc362fc26255cda45db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetSetFilePointer
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
urlmon
CreateURLMoniker
kernel32
GetLocaleInfoW
SetFilePointer
CloseHandle
CreateFileA
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
SizeofResource
FindResourceA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcess
Process32Next
OpenProcess
Process32First
GetCurrentProcessId
GetWindowsDirectoryA
CreateMutexA
GetFileAttributesA
InterlockedExchange
Sleep
InterlockedDecrement
CreateDirectoryA
CreateProcessA
GetTempPathA
lstrlenA
GetVersionExA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
HeapSize
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetModuleFileNameA
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapAlloc
LCMapStringW
LCMapStringA
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
CreateThread
GetCurrentThreadId
ExitThread
GetCPInfo
ExitProcess
RaiseException
IsBadCodePtr
IsBadReadPtr
RtlUnwind
HeapFree
MultiByteToWideChar
InterlockedIncrement
WideCharToMultiByte
user32
RegisterWindowMessageA
DestroyWindow
GetCursorPos
SetForegroundWindow
TrackPopupMenu
GetMenuItemID
LoadMenuA
GetSubMenu
DestroyMenu
SetMenuDefaultItem
IsWindow
SetTimer
PostMessageA
KillTimer
SendMessageA
PostQuitMessage
GetActiveWindow
MessageBoxA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
DialogBoxParamA
DefWindowProcA
LoadStringA
EndDialog
CreateWindowExA
ShowWindow
MoveWindow
UpdateWindow
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
shell32
Shell_NotifyIconA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
ole32
CoInitialize
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ