cum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cum.exe
Size 1.3MB
Sample260628-etwpvafs2l
SHA256 19e3f1bcdf235ff92318d27d79c274210dc4e09bde9cfd3f3ef3a28c5f5441a1
MD5 c72e359449d751f449fd32d8af370ee8
SHA1 1e2c59d7f721167ab59d911089e70c71e5457a1d
SHA512 d77640b2460f83a9b43d434cb4273d6be6a4ba12aaa21237fd1ecfdf1ad5177ba47bb0120d645ef6c657b59f3abe18439c438ce88854c94b3b2f5719a9892f68
SSDEEP 24576:Moad9qlWg5Hf9KlI1feUmmuezPLPKRUiYn9t1HCG+O93l0fZYR:rad98XYl8etEvPWhYn9tNt+O93+xY
TLSH
T1D055AD57A2A810FDD167C138C5479A07FBB2781913209FDF07E09A692F736E16E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cum.exe

File Explorer

cum.exe

.exe 1.3MB

cum.exe

IMPHASH 89673224b0896b3e5cc54382912b3ac9
SHA256 19e3f1bcdf235ff92318d27d79c274210dc4e09bde9cfd3f3ef3a28c5f5441a1
MD5 c72e359449d751f449fd32d8af370ee8
SHA1 1e2c59d7f721167ab59d911089e70c71e5457a1d
SHA512 d77640b2460f83a9b43d434cb4273d6be6a4ba12aaa21237fd1ecfdf1ad5177ba47bb0120d645ef6c657b59f3abe18439c438ce88854c94b3b2f5719a9892f68
SSDEEP 24576:Moad9qlWg5Hf9KlI1feUmmuezPLPKRUiYn9t1HCG+O93l0fZYR:rad98XYl8etEvPWhYn9tNt+O93+xY
TLSH
T1D055AD57A2A810FDD167C138C5479A07FBB2781913209FDF07E09A692F736E16E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

804664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\smk29\OneDrive\Desktop\3WF AND B6L Easy CRACK\Easy Crack\3WF AND B6L CRACK\x64\Release\cum.pdb

d3d9

Direct3DCreate9

psapi

GetModuleInformation

wininet

HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle HttpSendRequestA InternetOpenA

user32

CloseClipboard SetClipboardData GetClipboardData DispatchMessageA PeekMessageA PostThreadMessageA SetCursor TranslateMessage GetClientRect GetForegroundWindow IsWindowUnicode ScreenToClient SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard OpenClipboard LoadCursorA UnhookWindowsHookEx SetWindowsHookExA GetWindow GetWindowThreadProcessId EnumWindows MessageBoxA ClientToScreen ReleaseCapture GetCursorPos SetCursorPos GetWindowRect UpdateWindow GetSystemMetrics IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage

kernel32

CloseHandle DeviceIoControl OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetStdHandle ReadFile WriteFile CreateFileW IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError AddVectoredExceptionHandler WaitForSingleObject Sleep GetCurrentProcess TerminateProcess OpenProcess GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleHandleW LoadLibraryExA WakeAllConditionVariable GetSystemTimeAsFileTime GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next GetModuleFileNameA HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc CreateThread HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryW UnhandledExceptionFilter GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetVolumeInformationA SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW DeleteFileW GetComputerNameA

shell32

ShellExecuteW ShellExecuteA

advapi32

OpenProcessToken GetTokenInformation GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextA IsValidSid CopySid ConvertSidToStringSidA CryptGetHashParam GetLengthSid CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

ws2_32

recv send WSAGetLastError bind connect closesocket getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select ntohl getaddrinfo freeaddrinfo recvfrom sendto gethostname getpeername

ntdll

RtlImageNtHeader

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_frequency _Query_perf_counter ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

normaliz

IdnToAscii

wldap32

ord26 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore

userenv

UnloadUserProfile

vcruntime140

__std_exception_copy strstr __std_exception_destroy _CxxThrowException __current_exception_context memcpy memmove memset __C_specific_handler __std_terminate memchr strchr __current_exception memcmp strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type _register_thread_local_exe_atexit_callback _c_exit _exit terminate _beginthreadex exit abort _initterm_e _initterm _get_narrow_winmain_command_line _invoke_watson _seh_filter_exe _cexit _invalid_parameter_noinfo_noreturn _resetstkoflw _invalid_parameter_noinfo _errno strerror __sys_nerr _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _getpid

api-ms-win-crt-string-l1-1-0

strpbrk towlower strcspn strspn strlen _strdup strncpy _stricmp isupper wcslen strcpy_s tolower strncmp strcmp

api-ms-win-crt-heap-l1-1-0

realloc _callnewh calloc _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fgetc fgetpos fputc fread fsetpos __stdio_common_vsscanf _fseeki64 fwrite setvbuf ungetc feof fputs fopen fclose _popen _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf fgets _pclose _open __stdio_common_vsprintf_s _set_fmode _close _write fflush ftell __p__commode _read fseek _wfopen

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _access _stat64 _unlock_file _fstat64 remove

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-math-l1-1-0

acosf cosf sinf ceilf __setusermatherr fmodf _dclass sqrtf

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoll atoi strtoul strtoull

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv