cum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cum.exe
Size 1.3MB
Sample260628-evjrnse19w
SHA256 5a2f2cd4acf5be9e410bf2b68ada0836c708bc9858dd368f83e506fb53cdf62a
MD5 ad75fce9f4c0c7b47e40865bcf99635a
SHA1 d3e38df8c3c1ac80c0afa1ed425e58e857bbf995
SHA512 324cdcf08f0b8ee3b898a929fa75c26fd8aa290c03332b22280b8bd2f950897bfdeadd3d36215ce94610e5edb0b99e28c723d1e366f57cac546b70f5092e7758
SSDEEP 24576:0LlnhLz0+oPvPLSqxhqJ4z6GLLc3FiYnGsfPJe+O93l0fZi:EnhXWTShiOKKkYnGsf4+O93+xi
TLSH
T1D555AE57A2A511FDD16BC138C5429A07FBB2781913209FDF03E09A692F736E16E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cum.exe

File Explorer

cum.exe

.exe 1.3MB

cum.exe

IMPHASH fb5a23a642784db8831c95ca9ad9d539
SHA256 5a2f2cd4acf5be9e410bf2b68ada0836c708bc9858dd368f83e506fb53cdf62a
MD5 ad75fce9f4c0c7b47e40865bcf99635a
SHA1 d3e38df8c3c1ac80c0afa1ed425e58e857bbf995
SHA512 324cdcf08f0b8ee3b898a929fa75c26fd8aa290c03332b22280b8bd2f950897bfdeadd3d36215ce94610e5edb0b99e28c723d1e366f57cac546b70f5092e7758
SSDEEP 24576:0LlnhLz0+oPvPLSqxhqJ4z6GLLc3FiYnGsfPJe+O93l0fZi:EnhXWTShiOKKkYnGsf4+O93+xi
TLSH
T1D555AE57A2A511FDD16BC138C5429A07FBB2781913209FDF03E09A692F736E16E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

804168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\smk29\OneDrive\Desktop\3WF AND B6L Easy CRACK\Easy Crack\3WF AND B6L CRACK\x64\Release\cum.pdb

d3d9

Direct3DCreate9

psapi

GetModuleInformation

wininet

HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle HttpSendRequestA InternetOpenA

user32

CloseClipboard SetClipboardData GetClipboardData DispatchMessageA PeekMessageA PostThreadMessageA SetCursor GetClientRect TranslateMessage GetForegroundWindow IsWindowUnicode ScreenToClient SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard OpenClipboard LoadCursorA UnhookWindowsHookEx SetWindowsHookExA GetWindow GetWindowThreadProcessId EnumWindows MessageBoxA ClientToScreen ReleaseCapture GetCursorPos SetCursorPos GetWindowRect UpdateWindow GetSystemMetrics IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage

kernel32

CloseHandle DeviceIoControl OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetStdHandle ReadFile WriteFile CreateFileW IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError AddVectoredExceptionHandler WaitForSingleObject Sleep GetCurrentProcess TerminateProcess OpenProcess GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleHandleW LoadLibraryExA WakeAllConditionVariable GetSystemTimeAsFileTime GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next GetModuleFileNameA HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc CreateThread HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryW UnhandledExceptionFilter GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetVolumeInformationA SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW DeleteFileW GetComputerNameA

shell32

ShellExecuteW ShellExecuteA

advapi32

OpenProcessToken GetTokenInformation GetUserNameA CryptGenRandom CryptReleaseContext CryptAcquireContextA IsValidSid CopySid ConvertSidToStringSidA CryptGetHashParam GetLengthSid CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

ws2_32

recv send WSAGetLastError bind connect closesocket getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select ntohl getaddrinfo freeaddrinfo recvfrom sendto gethostname getpeername

ntdll

RtlImageNtHeader

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_frequency _Query_perf_counter ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

normaliz

IdnToAscii

wldap32

ord26 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore

userenv

UnloadUserProfile

vcruntime140

__std_exception_copy strstr __std_exception_destroy _CxxThrowException __current_exception_context memcpy memmove memset __C_specific_handler __std_terminate memchr strchr __current_exception memcmp strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type _register_thread_local_exe_atexit_callback _c_exit _exit terminate _beginthreadex exit abort _initterm_e _initterm _get_narrow_winmain_command_line _invoke_watson _seh_filter_exe _cexit _invalid_parameter_noinfo_noreturn _resetstkoflw _invalid_parameter_noinfo _errno strerror __sys_nerr _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _getpid

api-ms-win-crt-string-l1-1-0

strpbrk towlower strcspn strspn strlen _strdup strncpy _stricmp isupper wcslen strcpy_s tolower strncmp strcmp

api-ms-win-crt-heap-l1-1-0

realloc _callnewh calloc _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fgetc fgetpos fputc fread fsetpos __stdio_common_vsscanf _fseeki64 fwrite setvbuf ungetc feof fputs fopen fclose _popen _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf fgets _pclose _open __stdio_common_vsprintf_s _set_fmode _close _write fflush ftell __p__commode _read fseek _wfopen

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _access _stat64 _unlock_file _fstat64 remove

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-math-l1-1-0

acosf cosf sinf ceilf __setusermatherr fmodf _dclass sqrtf

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoll atoi strtoul strtoull

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv