sdfbn8[.]exe | Triage™

General

Target
sdfbn8.exe
Size 379KB
Sample260629-b3mlrabx3p
SHA256 818d6d87d0facc03354bf7b0748467cf61040031248ba8b46045ed9dbe4053d8
MD5 91a31f23f3e50bd0a722e605687aed1e
SHA1 f56fa26aaccdd6eb3f1ea53f06674b01327cd7c4
SHA512 649ee112c0e9d0c63c199f0dee84332f915af336dd7ad0ff70cbd49cc148c832182ff748c67fe1dee958215ea4a095545d1a93fdeb90fbdeb6f98076b499aab0
SSDEEP 6144:y0l5U6eUbNRNrOHh84pi8Y8ubTIlceF4knL7AL8tdwndOLv23+cr9JUPlJh:pyU5zOHy4pi8Y8ubTIlceF4knL7AmbvF
TLSH
T15D84292AEB9220F4EC77917C88D12306F7A075684771DBEBB39D451A4F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sdfbn8.exe

File Explorer

sdfbn8.exe

.exe 379KB

sdfbn8.exe

IMPHASH e3d5de629e09ae6898196a1418661d7f
SHA256 818d6d87d0facc03354bf7b0748467cf61040031248ba8b46045ed9dbe4053d8
MD5 91a31f23f3e50bd0a722e605687aed1e
SHA1 f56fa26aaccdd6eb3f1ea53f06674b01327cd7c4
SHA512 649ee112c0e9d0c63c199f0dee84332f915af336dd7ad0ff70cbd49cc148c832182ff748c67fe1dee958215ea4a095545d1a93fdeb90fbdeb6f98076b499aab0
SSDEEP 6144:y0l5U6eUbNRNrOHh84pi8Y8ubTIlceF4knL7AL8tdwndOLv23+cr9JUPlJh:pyU5zOHy4pi8Y8ubTIlceF4knL7AmbvF
TLSH
T15D84292AEB9220F4EC77917C88D12306F7A075684771DBEBB39D451A4F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer DecodePointer FlsFree SetLastError FlsSetValue FlsGetValue GetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx SetConsoleCtrlHandler FreeLibrary SetHandleCount LoadLibraryExW HeapFree HeapAlloc GetCPInfo GetACP GetOEMCP Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc VirtualProtect VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle WriteFile ExitProcess GetModuleHandleW GetProcAddress SetUnhandledExceptionFilter GetVersionExW InitializeCriticalSectionAndSpinCount GetCommandLineA SetEndOfFile SetStdHandle GetSystemFirmwareTable GetVersionExA SetThreadExecutionState CreateMutexA SetProcessAffinityMask GetCurrentDirectoryA GetModuleHandleA DeleteFileA GetWindowsDirectoryA LoadLibraryA GetSystemDirectoryA CloseHandle GetFullPathNameA CreateNamedPipeA CreateFileA ReadFile CreateThread LocalFree DeviceIoControl LocalSize LocalAlloc lstrlenA FormatMessageA ReadConsoleInputA SetConsoleMode GetConsoleMode HeapSize GetConsoleCP FlushFileBuffers CreateFileW WriteConsoleW SetFilePointer GetProcessHeap

advapi32

StartServiceA OpenSCManagerA OpenServiceA CloseServiceHandle QueryServiceStatusEx ControlService DeleteService OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA CreateServiceA

shell32

ShellExecuteA

user32

ExitWindowsEx RegisterClassExA DefWindowProcA DispatchMessageA BlockInput GetMessageA MessageBoxA CreateWindowExA SystemParametersInfoA TranslateMessage

Sharing