anubis[.]exe | Triage™

Resubmissions

03/05/2026, 03:41

260503-d8tclaey3q

03/05/2026, 03:38

260503-d7dkrabs4w3

Sharing

Copy URL Twitter E-mail

General

Target
anubis.exe
Size 423KB
Sample260503-d8tclaey3q
SHA256 a45e160db2a13990d44e174ee5cf91d2b2489764efc1f6394153b10b57884dc2
MD5 75c2d9591d12b354aece4e6bfcffd951
SHA1 4c358a082f484797d2508b7d280efbaf0b18548f
SHA512 ef05bcae17996e2074a9efca774aef622ceca5087f0caf6cc8cf75e7b4b59f0a02024554e14a3c133440f8ad609bf816e2cab161b5c3c905e5ce2c49216c4781
SSDEEP 6144:zvrdr4k044ZnC0uNm2ENOzbT8L2uvRUR/6+EKpHK8SpzjrVgiin6Efk9o4:zj0XZnCtEQz8LHpJ+EKs84yiintfke
TLSH
T1F094AD12F1A440FDE06FD078C597A917EA31384D07205ADB63E49DA52FB27E09EBE706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
anubis.exe

File Explorer

anubis.exe

.exe 423KB

anubis.exe

IMPHASH b611446aa8846474d7284886cc3bc515
SHA256 a45e160db2a13990d44e174ee5cf91d2b2489764efc1f6394153b10b57884dc2
MD5 75c2d9591d12b354aece4e6bfcffd951
SHA1 4c358a082f484797d2508b7d280efbaf0b18548f
SHA512 ef05bcae17996e2074a9efca774aef622ceca5087f0caf6cc8cf75e7b4b59f0a02024554e14a3c133440f8ad609bf816e2cab161b5c3c905e5ce2c49216c4781
SSDEEP 6144:zvrdr4k044ZnC0uNm2ENOzbT8L2uvRUR/6+EKpHK8SpzjrVgiin6Efk9o4:zj0XZnCtEQz8LHpJ+EKs84yiintfke
TLSH
T1F094AD12F1A440FDE06FD078C597A917EA31384D07205ADB63E49DA52FB27E09EBE706
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

323728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Student\Downloads\rose\build\anubis.pdb

ntdll

NtQueryInformationProcess

winhttp

WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse WinHttpQueryDataAvailable

kernel32

GetModuleHandleA GetProcAddress QueryPerformanceCounter Sleep SetThreadPriority GetCurrentThread Process32First TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetCurrentProcessId GetCurrentProcess RaiseException GetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReadProcessMemory GetStdHandle SetCurrentConsoleFontEx GetCurrentConsoleFontEx ExitProcess SetConsoleCP SetConsoleOutputCP Module32Next Module32First GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleW WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead GetProcessId

user32

ClientToScreen GetClientRect GetSystemMetrics FindWindowExA GetWindowTextA GetAsyncKeyState FindWindowA SendInput GetDC ScreenToClient ReleaseDC GetCursorPos

gdi32

CreateCompatibleBitmap BitBlt DeleteObject SelectObject CreateCompatibleDC DeleteDC

ole32

CoCreateInstance CLSIDFromString CoInitializeEx CreateStreamOnHGlobal

msvcp140

?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Thrd_detach ?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Cnd_do_broadcast_at_thread_exit

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipSaveImageToStream GdiplusShutdown GdipCloneImage GdiplusStartup GdipAlloc

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy __current_exception memset memmove memcpy memchr __C_specific_handler strstr __std_terminate memcmp

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

ceilf sqrtf sinf __setusermatherr acosf cosf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fwrite __stdio_common_vfprintf fclose fflush __acrt_iob_func __p__commode _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

tolower _stricmp wcscpy_s strcmp strlen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initialize_onexit_table _cexit _initialize_narrow_environment _set_app_type _configure_narrow_argv _get_initial_narrow_environment _initterm _initterm_e _exit __p___argv _c_exit _register_thread_local_exe_atexit_callback __p___argc _beginthreadex system _register_onexit_function exit _seh_filter_exe terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale