combotoolbox[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

combotoolbox.exe
Size

898KB
MD5

c94bab8fd485263de3527b1a5cc57b92
SHA1

4c7cead410b60c31f272146c85b4d866c02fb59d
SHA256

3c3041d644cc8a32aa3b7d01e42d95dacf1d5b30a7d949a04b14e410540cbf26
SHA512

a37bd4d5950c85f7b36798172b3a73ff82ec45b1f84a21a4ac5e8703695d01134094526db9d375224096b59fd546dfd2cc4e792f990d1749ee18861bf06c9723
SSDEEP

12288:S9MNBwjgRgIVYOfB2AsyNb2AVzSBN+EHZNDM4nK1m:SaBwjgFtBPbJNSBN+EXM4Km

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
combotoolbox.exe

Files

combotoolbox.exe
.exe windows:6 windows x64 arch:x64

3594fe986dcdd575fce4977e7e9a687e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
SetConsoleActiveScreenBuffer
GetProcAddress
GetCurrentThreadId
GetModuleHandleA
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
CreateConsoleScreenBuffer
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentProcess
Sleep
InitializeSListHead
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
IsDebuggerPresent
UnhandledExceptionFilter
SetWaitableTimer
SetUnhandledExceptionFilter
WaitForMultipleObjects
GetTimeZoneInformationForYear
SetConsoleTitleA
GetCurrentProcessId
SetConsoleMode
SetHandleInformation
WriteFileEx
SleepEx
GetExitCodeProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapFree
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
SetConsoleCursorInfo
SetConsoleCursorPosition
CreateDirectoryW
FindFirstFileW
SetConsoleTextAttribute
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CreateFileW
GetConsoleMode
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetStdHandle
GetSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent

ws2_32

WSASocketW
getaddrinfo
closesocket
WSAGetLastError
freeaddrinfo
connect
WSACleanup
WSAStartup
send

user32

GetForegroundWindow
GetKeyboardLayout
ToUnicodeEx
GetWindowThreadProcessId

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

vcruntime140

memset
__C_specific_handler
__CxxFrameHandler3
memcpy
memcmp
memmove
_CxxThrowException
__current_exception_context
__current_exception

api-ms-win-crt-math-l1-1-0

__setusermatherr
round

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_initterm_e
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_get_initial_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_set_app_type
_crt_atexit
terminate
_seh_filter_exe
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 557KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3594fe986dcdd575fce4977e7e9a687e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

user32

bcrypt

advapi32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 557KB - Virtual size: 556KB

.rdata Size: 207KB - Virtual size: 207KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 24KB - Virtual size: 23KB

.rsrc Size: 105KB - Virtual size: 104KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 557KB - Virtual size: 556KB

.rdata
Size: 207KB - Virtual size: 207KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 105KB - Virtual size: 104KB

.reloc
Size: 3KB - Virtual size: 2KB