caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade.exe
Size 41KB
Sample240601-b9c1wsed62
SHA256 caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade
MD5 d24dcca23dff95a4809d6247c4c4ca20
SHA1 7d7b01dc1c5640b9a1f4ddb51a7eab16c4ab26b8
SHA512 4a0c88b5c65c754f7e6e2dac79aee176e8efccec6b900d2fc0587e5689d9b2972be4da73d056da4f56fbb89d561b4c955e5a29099b4eb3ef35758f261ee17154
SSDEEP 768:qZk2J35U2UTDt1dttrHJxg8QrI0XTjcVTGHKUpmwTP:sk2B5lUHt/rpxCrRjj2vU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade.exe

File Explorer

caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade.exe

.exe 41KB

caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade.exe

IMPHASH cef9b2d2f8d73f7722bfff3294832582
SHA256 caef870a200ba4982a21e3ae2c52284cd2fb8b5367a5ff7268f40e21d6d2cade
MD5 d24dcca23dff95a4809d6247c4c4ca20
SHA1 7d7b01dc1c5640b9a1f4ddb51a7eab16c4ab26b8
SHA512 4a0c88b5c65c754f7e6e2dac79aee176e8efccec6b900d2fc0587e5689d9b2972be4da73d056da4f56fbb89d561b4c955e5a29099b4eb3ef35758f261ee17154
SSDEEP 768:qZk2J35U2UTDt1dttrHJxg8QrI0XTjcVTGHKUpmwTP:sk2B5lUHt/rpxCrRjj2vU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\andy\Desktop\免杀对抗\116-dll&syscall-dll项目&代码&复现环境等\4\EDR-Bypass-demo-main\chapter4-demo3\x64\Release\demo1.pdb

kernel32

GetCurrentProcess VirtualAlloc WaitForSingleObject OpenProcess GetSystemInfo VirtualQueryEx RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

msvcp140

?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memset __current_exception_context __current_exception memcpy _CxxThrowException __C_specific_handler __std_exception_copy __std_exception_destroy memchr memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _exit exit _initterm_e terminate __p___argv _initterm _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo_noreturn _register_onexit_function

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale