cmdbkg[.]exe | Triage

Resubmissions

21-04-2024 12:54

240421-p5ewksbh72 3

Sharing

Copy URL

Twitter E-mail

General

Target

cmdbkg.exe
Size

24KB
MD5

36050e30e659b685501bbcb1e91eaa80
SHA1

c9bafdbdc725aea0342c201a00f829162c69ed64
SHA256

c616f22db40d43f720cf95fc99cfb2676fa9eccb7990e28cac96fedfed721b01
SHA512

a9f5751b9694337df9db3ce58843fb4b6cd2425115b2e8009bc372b8b154571ae3d13130c54b9a57c9c1a3585f7c4d0ba3f953fc2a727be0beb4283cff336a23
SSDEEP

384:56XVcKT09UyflHybR02faEE0zw26o73IhLcLa6S31s4t4mq97uSKl2J30:0cKTmflSRVf/E0kfZcLi1Lu30

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cmdbkg.exe

Files

cmdbkg.exe
.exe windows:4 windows x86 arch:x86

ef8cd7f18a9b59b15033fbc2e15348e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

dwmapi

DwmGetWindowAttribute

gdi32

BitBlt
CreateCompatibleDC
CreateSolidBrush
DeleteDC
DeleteObject
GetObjectW
SelectObject

gdiplus

GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdiplusShutdown
GdiplusStartup

kernel32

CloseHandle
CreateEventW
CreateFileW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FreeConsole
FreeLibrary
GetCommandLineW
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStartupInfoW
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
Process32FirstW
Process32NextW
PulseEvent
QueryPerformanceCounter
ReadConsoleOutputAttribute
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
_wcsicmp
abort
calloc
exit
fprintf
fputs
free
fwrite
malloc
memcmp
memcpy
puts
signal
strlen
strncmp
vfprintf
wcscmp
wcstoul

shell32

CommandLineToArgvW

user32

CopyImage
CreateWindowExW
DefWindowProcW
DispatchMessageW
EnumWindows
GetDC
GetForegroundWindow
GetMessageW
GetMonitorInfoW
GetSystemMetrics
GetWindowLongW
GetWindowRect
GetWindowThreadProcessId
IsIconic
IsWindow
KillTimer
LoadCursorW
MonitorFromWindow
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassW
ReleaseDC
SendMessageW
SendNotifyMessageW
SetForegroundWindow
SetLayeredWindowAttributes
SetTimer
SetWinEventHook
SetWindowLongW
SetWindowPos
UnhookWinEvent
WaitForInputIdle

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

ef8cd7f18a9b59b15033fbc2e15348e2

Headers

File Characteristics

Imports

dwmapi

gdi32

gdiplus

kernel32

msvcrt

shell32

user32

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 60B

.rdata Size: 2KB - Virtual size: 1KB

.eh_fram Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 60B

.rdata
Size: 2KB - Virtual size: 1KB

.eh_fram
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB