LayyB0R[.]exe | Triage™

General

Target
LayyB0R.exe
Size 2.6MB
Sample250108-razcvasmgy
SHA256 00b1dbb467fd9362fd4f5a3e76ef16f3b4abe4fb620e62aa00a7bdae67c0042a
MD5 46fe008a90da36053c2283f88baf327a
SHA1 d4468911d1a9d52029a87045b7fe3e48288b0c68
SHA512 3761b0c42a9e4bdfd5c52ccc23217cd60eb5306dcf34c1f462e23442b88b33abb2fe4b428493eb8fa79752803d5b567893512dd3888de0ddbb3a091fae0ca2dd
SSDEEP 6144:YsjqaYcd6M9VwdL94slc8+Yl7aZilp3c52RiMAMl5jpNVXi2Z9Z+T7fcdY/bYT6/:BqaYcEMAnH7aADcIAmpNVXi2Z/+T74Q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LayyB0R.exe

File Explorer

LayyB0R.exe

.exe 2.6MB

LayyB0R.exe

IMPHASH f19e46a0d9a4cc2995291670215cf69f
SHA256 00b1dbb467fd9362fd4f5a3e76ef16f3b4abe4fb620e62aa00a7bdae67c0042a
MD5 46fe008a90da36053c2283f88baf327a
SHA1 d4468911d1a9d52029a87045b7fe3e48288b0c68
SHA512 3761b0c42a9e4bdfd5c52ccc23217cd60eb5306dcf34c1f462e23442b88b33abb2fe4b428493eb8fa79752803d5b567893512dd3888de0ddbb3a091fae0ca2dd
SSDEEP 6144:YsjqaYcd6M9VwdL94slc8+Yl7aZilp3c52RiMAMl5jpNVXi2Z9Z+T7fcdY/bYT6/:BqaYcEMAnH7aADcIAmpNVXi2Z/+T74Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetThreadContext GetNumaNodeProcessorMask SetDefaultCommConfigA CreateProcessW InterlockedIncrement GetEnvironmentStringsW CancelWaitableTimer InterlockedCompareExchange GetComputerNameW GetTimeFormatA GetModuleHandleW GetCurrentThread GetDateFormatA SetProcessPriorityBoost GetVolumePathNameW LoadLibraryW GetConsoleAliasW GetStartupInfoW GetShortPathNameA GetStartupInfoA SetLastError GetProcAddress SearchPathA SetFileAttributesA GetAtomNameA UnhandledExceptionFilter LocalAlloc DeleteTimerQueue AddAtomA FindAtomA FoldStringA OpenFileMappingW FindFirstVolumeW GetModuleHandleA HeapAlloc GetCommandLineA TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetLastError WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA CloseHandle RaiseException

user32

GetProcessDefaultLayout

Name

.text

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gima

Size

18KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tabiya

Size

512B

Virtual Size

346B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

LayyB0R.exe

kernel32

user32

generic