CFB8[.]exe | Triage™

General

Target
CFB8.exe
Size 221KB
Sample260713-eef1vabx4p
SHA256 4a105f3deb996b174a890199fd375e25f8c788da014afc851f7ad1e59b5b42a8
MD5 d7d112dc700a910effc21009bf7dd363
SHA1 bc2650244289a3f98ec2f6881cc5861932852c5a
SHA512 6792efb6e92c70c699c55dd9771cfc875b6066f55d634c21f330e6829dd43d012104a5235cf55c8f67c59bf91239576b2285776c9262c89ef2ae0f8e441766eb
SSDEEP 3072:W4sVYU6QWld6sVTZWxNB7pCvyzoz19ZCuRsf60dQJq6xr8sEkQED26VFg:WhMTZWzZ8aE1Im0lN6z
TLSH
T150248E45B3A41CF9E57B8539CD414A05EA72BC8647A0E7CF13A40AD68F237E09E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CFB8.exe

File Explorer

CFB8.exe

.exe 221KB

CFB8.exe

IMPHASH 63a5f16c7a8e96463a977cd02a7b6593
SHA256 4a105f3deb996b174a890199fd375e25f8c788da014afc851f7ad1e59b5b42a8
MD5 d7d112dc700a910effc21009bf7dd363
SHA1 bc2650244289a3f98ec2f6881cc5861932852c5a
SHA512 6792efb6e92c70c699c55dd9771cfc875b6066f55d634c21f330e6829dd43d012104a5235cf55c8f67c59bf91239576b2285776c9262c89ef2ae0f8e441766eb
SSDEEP 3072:W4sVYU6QWld6sVTZWxNB7pCvyzoz19ZCuRsf60dQJq6xr8sEkQED26VFg:WhMTZWzZ8aE1Im0lN6z
TLSH
T150248E45B3A41CF9E57B8539CD414A05EA72BC8647A0E7CF13A40AD68F237E09E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

32380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime CloseHandle GetLastError WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetProcAddress GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW RtlUnwind

Name

.text

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CFB8.exe

kernel32

generic