C:\Users\EtoShinya\source\repos\M\x64\Release\minty.pdb
Static task
static1
Behavioral task
behavioral1
Sample
anubisspoofer.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
anubisspoofer.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Anubis.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Anubis.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
spooferconfig.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
spooferconfig.dll
Resource
win10v2004-20240802-en
General
-
Target
anubisspoofer.rar
-
Size
2.2MB
-
MD5
6170ea8536ac22e4fe9765d466eb2475
-
SHA1
75fd34b11bc71181131c0d8bec005d6d9b0c87bc
-
SHA256
939cdd940184fa0be3ac8de9330d66e144d93396098713278e736e6ab1396f72
-
SHA512
120b17b2364f579e0e95e7a06358d4f175f5d599c884b7e8de0d384d12e908b80dd5b011d3d7ba643e99d4cc58b7813f71e98a9e95ab8b8f131a391a0253edf0
-
SSDEEP
49152:NnnY9AataBTX5T8oqMldG7p7DlvSIC2mZac6BYfX9gUmGMP0xBiMh8Y9p:NnnPBTX5T88lE97D62+nPXfnc0riMfD
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Anubis.exe unpack001/spooferconfig.dll
Files
-
anubisspoofer.rar.rar
-
Anubis.exe.exe windows:4 windows x86 arch:x86
a9c887a4f18a3fede2cc29ceea138ed3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit
shell32
ShellExecuteA
kernel32
SetUnhandledExceptionFilter
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
spooferconfig.dll.dll windows:6 windows x64 arch:x64
7e8ab85d38ca9ddc32f9ba426542109f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetModuleHandleA
LockResource
LoadResource
GetModuleFileNameA
VirtualProtect
GetCurrentProcess
Sleep
CreateFileA
GetProcAddress
lstrcmpiW
GetCurrentThreadId
OpenThread
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
LoadLibraryExA
FormatMessageA
CreateThread
AllocConsole
QueueUserAPC
GetModuleHandleW
FreeResource
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
SizeofResource
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
GetLocaleInfoEx
GetCurrentThread
GetTickCount64
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
AreFileApisANSI
PeekNamedPipe
WriteFile
FindResourceA
ReadFile
SuspendThread
VirtualQuery
user32
CloseClipboard
EmptyClipboard
ReleaseCapture
OpenClipboard
GetCursorPos
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
EnumWindows
GetClassNameA
ScreenToClient
GetWindowThreadProcessId
RegisterClassExA
SetWindowLongPtrA
CreateWindowExA
DefWindowProcA
CallWindowProcA
FindWindowA
LoadCursorA
SetClipboardData
GetKeyState
GetClipboardData
GetMessageExtraInfo
SetCursorPos
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uncaught_exceptions@std@@YAHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Random_device@std@@YAIXZ
_Cnd_broadcast
_Mtx_unlock
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
_Cnd_timedwait
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Mtx_current_owns
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
msvcp140_codecvt_ids
?id@?$codecvt@_SDU_Mbstatet@@@std@@2V0locale@2@A
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySection
NtProtectVirtualMemory
RtlVirtualUnwind
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__std_terminate
__intrinsic_setjmp
memmove
memcmp
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memset
memcpy
strrchr
longjmp
strstr
strchr
memchr
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll
abort
_wassert
exit
_errno
system
_beginthreadex
_configure_narrow_argv
terminate
strerror
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf_s
fseek
feof
fread
fputc
tmpnam
__stdio_common_vswprintf
fflush
fgetc
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
__acrt_iob_func
fgetpos
setvbuf
_ftelli64
_popen
tmpfile
ungetc
_pclose
clearerr
fgets
fsetpos
_fseeki64
fclose
getc
fopen
ferror
freopen
_get_stream_buffer_pointers
_wfopen
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
api-ms-win-crt-time-l1-1-0
_gmtime64
strftime
_mktime64
clock
_difftime64
_time64
_localtime64
api-ms-win-crt-string-l1-1-0
isblank
isalnum
toupper
strcmp
isspace
strspn
isdigit
isxdigit
_strdup
strpbrk
strcoll
islower
ispunct
iscntrl
isalpha
strncmp
strncpy
isgraph
isupper
tolower
api-ms-win-crt-convert-l1-1-0
atof
strtod
strtoull
strtoul
strtoll
api-ms-win-crt-math-l1-1-0
sinf
sin
pow
logf
tan
log10
log
fmodf
fmod
_dsign
ldexp
_dclass
acos
acosf
asin
atan2
frexp
atan2f
ceil
ceilf
sqrtf
cos
sqrt
cosf
exp
floor
floorf
powf
api-ms-win-crt-filesystem-l1-1-0
remove
_lock_file
rename
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
setlocale
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 963KB - Virtual size: 963KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 113KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ