anubis_Shipping_Steam_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
anubis_Shipping_Steam_x64.exe
Size 10.5MB
Sample260415-sd63jaax9n
SHA256 b8f131037187ca8d0a282527fb6f55a2012241d5b9dac8bf2038baf35b71a76d
MD5 04ce7cd21676ef0e01524afd1d8a3a52
SHA1 013655892053b5ebe016a409445bc3136aa7bcd8
SHA512 0165604e5eae88500d90857c05a3c0523daaa489b3612a96edfaed99ca02aba17e88ca7eae1a4c9f260f4e122e52e8850f46955fda0f7c865db3bd1ea1ca62e4
SSDEEP 49152:NyxYzamgqxOkIdx9U/drjWmIH93DC4CvBcUZEg5uqIVYGlauoqJ695kjQiDy8/b5:NwkI+eUl5qrlaoJs7iz/bnNtIB4R
TLSH
T126B6BF9A71B500E9D0ABD0BCCA06A117E77234151734ABDB17E08ABA6F73DD01E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
anubis_Shipping_Steam_x64.exe

File Explorer

anubis_Shipping_Steam_x64.exe

.exe 10.5MB

anubis_Shipping_Steam_x64.exe

IMPHASH df1608145e172ed76f16576ac84e540c
SHA256 b8f131037187ca8d0a282527fb6f55a2012241d5b9dac8bf2038baf35b71a76d
MD5 04ce7cd21676ef0e01524afd1d8a3a52
SHA1 013655892053b5ebe016a409445bc3136aa7bcd8
SHA512 0165604e5eae88500d90857c05a3c0523daaa489b3612a96edfaed99ca02aba17e88ca7eae1a4c9f260f4e122e52e8850f46955fda0f7c865db3bd1ea1ca62e4
SSDEEP 49152:NyxYzamgqxOkIdx9U/drjWmIH93DC4CvBcUZEg5uqIVYGlauoqJ695kjQiDy8/b5:NwkI+eUl5qrlaoJs7iz/bnNtIB4R
TLSH
T126B6BF9A71B500E9D0ABD0BCCA06A117E77234151734ABDB17E08ABA6F73DD01E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4541040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\SupFiles\Coding Projects\Nightdive\powerslaveex\kex3_anubis\bin\x64\anubis_Shipping_Steam_x64.pdb

ws2_32

freeaddrinfo getaddrinfo WSAStartup closesocket htons recvfrom sendto bind htonl ioctlsocket WSACleanup WSAGetLastError socket

kernel32

lstrcpyA CreateFileA SetFilePointer WriteFile lstrlenA VirtualQuery FileTimeToLocalFileTime FileTimeToDosDateTime GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryA GetProcAddress GetCurrentProcessId GetCurrentProcess CloseHandle GetModuleHandleA GetLocaleInfoA OutputDebugStringA DebugBreak TerminateProcess RaiseException IsDebuggerPresent CreateDirectoryW GetLastError GetStdHandle GetFileInformationByHandle AllocConsole SetConsoleTitleA GetFileAttributesW MultiByteToWideChar WideCharToMultiByte SetFileAttributesW GetFileAttributesExW MoveFileExW RemoveDirectoryW ReadFile FlushFileBuffers DeleteFileW CreateFileW VirtualAlloc VirtualFree CreatePipe SetHandleInformation CreateProcessA CreateToolhelp32Snapshot Process32First InitializeSRWLock AcquireSRWLockShared ReleaseSRWLockShared LocalFree ReleaseSRWLockExclusive TryAcquireSRWLockExclusive LoadLibraryW CreateEventA FreeLibrary SetEvent ResetEvent WaitForSingleObject CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetNumaNodeProcessorMaskEx SetThreadAffinityMask SetThreadPriority RtlCaptureContext GetLogicalDrives GetDriveTypeA UnhandledExceptionFilter GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFullPathNameW AreFileApisANSI SleepConditionVariableSRW GlobalFree GlobalLock GlobalUnlock ExitProcess GlobalAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc CreateSemaphoreW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCommandLineW FormatMessageA AcquireSRWLockExclusive GetTickCount64 WaitForSingleObjectEx Process32Next GetFileInformationByHandleEx SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead

user32

CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx wsprintfA wvsprintfA SendMessageA LoadIconA SetClipboardData CloseClipboard OpenClipboard GetClipboardData EmptyClipboard

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA SHFileOperationW

ole32

CoTaskMemFree

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey GetUserNameA

xaudio2_9redist

ord1 ord2 ord6 ord5

sdl2

SDL_calloc SDL_wcslen SDL_iconv_string SDL_SetMainReady SDL_ShowSimpleMessageBox SDL_GetPerformanceFrequency SDL_GetPerformanceCounter SDL_Delay SDL_UpdateWindowSurface SDL_UpperBlitScaled SDL_ConvertSurface SDL_GetWindowSurface SDL_FreeSurface SDL_RWFromFile SDL_LoadBMP_RW SDL_SetCursor SDL_CreateCursor SDL_GetCursor SDL_SetRelativeMouseMode SDL_PollEvent SDL_WarpMouseInWindow SDL_GetModState SDL_StopTextInput SDL_StartTextInput SDL_GetRelativeMouseState SDL_GetMouseState SDL_GameControllerName SDL_GameControllerGetSensorData SDL_GameControllerGetProduct SDL_GameControllerGetVendor SDL_GameControllerGetJoystick SDL_GameControllerOpen SDL_IsGameController SDL_NumJoysticks SDL_GameControllerSetSensorEnabled SDL_GameControllerHasSensor SDL_GameControllerGetAxis SDL_GameControllerClose SDL_GameControllerAddMappingsFromRW SDL_RWFromConstMem SDL_GetHint SDL_SetHint SDL_PumpEvents SDL_Quit SDL_QuitSubSystem SDL_GetPrefPath SDL_GetCPUCount SDL_JoystickInstanceID SDL_UnloadObject SDL_GL_GetProcAddress SDL_LoadFunction SDL_LoadObject SDL_SetClipboardText SDL_GetClipboardText SDL_ShowMessageBox SDL_RaiseWindow SDL_HideWindow SDL_ShowWindow SDL_GetBasePath SDL_SetWindowGrab SDL_SetWindowTitle SDL_GetWindowFlags SDL_GetDisplayUsableBounds SDL_GetDisplayMode SDL_GetNumDisplayModes SDL_DisableScreenSaver SDL_GetWindowSize SDL_GetDisplayName SDL_SetWindowSize SDL_SetWindowDisplayMode SDL_GetClosestDisplayMode SDL_GetWindowBordersSize SDL_GetCurrentDisplayMode SDL_ShowCursor SDL_Init SDL_CreateWindow SDL_GetNumVideoDisplays SDL_GameControllerGetAttached SDL_GetDesktopDisplayMode SDL_DestroyWindow SDL_free SDL_MinimizeWindow SDL_GetWindowWMInfo SDL_HapticRumblePlay SDL_HapticUnpause SDL_HapticUpdateEffect SDL_HapticPause SDL_JoystickGetDeviceInstanceID SDL_HapticClose SDL_HapticDestroyEffect SDL_GetError SDL_HapticRumbleStop SDL_HapticRumbleInit SDL_HapticRumbleSupported SDL_HapticRunEffect SDL_HapticNewEffect SDL_HapticQuery SDL_HapticOpenFromJoystick SDL_JoystickIsHaptic

steam_api64

SteamAPI_RegisterCallResult SteamAPI_UnregisterCallback SteamAPI_Shutdown SteamAPI_UnregisterCallResult SteamAPI_RegisterCallback SteamInternal_ContextInit SteamAPI_RestartAppIfNecessary SteamAPI_RunCallbacks SteamAPI_Init SteamAPI_GetHSteamUser SteamInternal_FindOrCreateUserInterface

msvcp140

?_Winerror_map@std@@YAHH@Z _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z _Cnd_wait _Cnd_broadcast _Cnd_signal _Mtx_unlock _Mtx_trylock _Mtx_lock _Thrd_yield _Thrd_detach _Thrd_join _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter _Query_perf_frequency _Thrd_hardware_concurrency ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$numpunct@D@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??0_Lockit@std@@QEAA@H@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??1_Locinfo@std@@QEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

dxgi

CreateDXGIFactory

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile D3DReflect

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception __current_exception_context __intrinsic_setjmp __RTDynamicCast __std_terminate memchr memset memmove memcpy longjmp __std_type_info_compare strrchr strchr memcmp strstr __C_specific_handler __std_exception_copy __std_exception_destroy _purecall

api-ms-win-crt-heap-l1-1-0

_aligned_realloc calloc malloc realloc _callnewh _aligned_free free _aligned_malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

sinf _dclass _dsign logf acosf cosf ceilf _fdsign ldexp sqrtf log pow atan ceil exp sqrt cos sin _ldsign roundf _fdclass _ldclass atan2f floorf floor modff log10f tanf fmod fmodf powf __setusermatherr

api-ms-win-crt-runtime-l1-1-0

exit _errno abort _exit _beginthreadex _invoke_watson _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __p__commode _getcwd fputc __stdio_common_vsprintf _wfopen _set_fmode __stdio_common_vsprintf_s fputs fflush _kbhit _wfreopen fopen_s fgets fread __stdio_common_vfprintf __stdio_common_vsscanf ferror fseek fclose _fseeki64 ftell fopen rewind fwrite __acrt_iob_func

api-ms-win-crt-string-l1-1-0

isupper strcpy_s strcmp _strnicmp strlen strcpy isspace tolower isdigit isxdigit strncmp _stricmp strcspn iscntrl toupper strtok strncpy

api-ms-win-crt-convert-l1-1-0

strtoull atoi strtod atof atol strtol mbstowcs

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-time-l1-1-0

asctime _ctime64 _time64 _localtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _findclose rename _fullpath _wfindfirst64i32 _wfindnext64i32

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-conio-l1-1-0

_getch

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=33140,

count=2, id=253, version=35207,

count=4, id=259, version=35207,

count=10, id=260, version=35207,

count=39, id=261, version=35207,

count=6, id=257, version=35207,

count=1, id=259, version=35214,

count=36, id=261, version=35214,

count=97, id=260, version=35214,

count=2, id=257, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=257, version=27043,

count=1, id=262, version=33140,

count=550, id=1, productName=Unmarked objects,

count=21, id=257, version=33140,

count=312, id=265, version=35214,

count=1, id=256, version=35214,

count=1, id=255, version=35214,

count=1, id=258, version=35214,