matanbuchus | 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

General

Target
0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
Size 579KB
Sample250818-x2vfvsxjx9
SHA256 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
MD5 a86c153cfb39fc0bbaf573acaef27f93
SHA1 1ff08496b459903acaf475ad39d0387e44b4d721
SHA512 1ba9e4413ffd7a27fe55d289e12bbac6a7388ef2c97065cc6503f6d66f8ec06a72109e0b7d9137219013ef3ce0f4d09aaf38f28bf1d355f5dd3ec01dc012d2de
SSDEEP 12288:1qqEj9B8vyNqf208h7ch7c8JtaEnNoWo:Ebn7o7rNoWo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

matanbuchus

Malware Config

Extracted

Family

matanbuchus

C2

https://emorista.org/libraries3.aspx

Signatures

Matanbuchus family
matanbuchus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

File Explorer

0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

.dll 579KB

0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

IMPHASH 77fe109335e7ab6ad9c3ce6f6fc3c929
SHA256 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c
MD5 a86c153cfb39fc0bbaf573acaef27f93
SHA1 1ff08496b459903acaf475ad39d0387e44b4d721
SHA512 1ba9e4413ffd7a27fe55d289e12bbac6a7388ef2c97065cc6503f6d66f8ec06a72109e0b7d9137219013ef3ce0f4d09aaf38f28bf1d355f5dd3ec01dc012d2de
SSDEEP 12288:1qqEj9B8vyNqf208h7ch7c8JtaEnNoWo:Ebn7o7rNoWo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

350475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetDriveTypeA GetFileAttributesA GetFileType GetFullPathNameW GetFullPathNameA GetTempFileNameW GetTempPathW GetTempPathA GetTempFileNameA GetLastError SetLastError HeapAlloc HeapReAlloc GetProcessHeap GetTickCount GetSystemDirectoryA GetSystemDirectoryW GetWindowsDirectoryA GetWindowsDirectoryW GetCurrentDirectoryA GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryExA LoadLibraryA LoadLibraryW lstrlenA lstrlenW WideCharToMultiByte GetACP GetCPInfo WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetEnvironmentVariableW GetModuleFileNameA GetEnvironmentVariableA GetConsoleOutputCP WriteFile IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwind InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException ExitProcess GetModuleHandleExW HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetStdHandle GetStringTypeW HeapSize SetStdHandle FlushFileBuffers DecodePointer

user32

GetTopWindow GetActiveWindow GetCursorPos IsWindow IsWow64Message GetParent IsWindowVisible

advapi32

GetUserNameA GetUserNameW

shlwapi

StrCmpIW

Resubmissions

Sharing