cursob[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cursob.exe
Size 2.8MB
Sample260716-rlj3asft2l
SHA256 937034bdff45ced5839e1a020fec2761eade8745664db9248784d0eba61fa652
MD5 08621019af5403f0c2f56e94efb7ee54
SHA1 b2cbd100ca4b9a95f1e98b9067d443904786ca47
SHA512 500e8d82a1edce2a8018ec6bfc657153c3ad63914b36e8e26c41b3d6c07f6e7774bda67de000ebddcca0567bec5a3e2178fe7f87fd07a16423dfbbcf941618c8
SSDEEP 49152:5Ix94PLKR0VMC7w0hqLk7JeMk3Ka7NTSYjhklDoR:Thw0hqLk7JeH3FSYjhklDoR
TLSH
T1EAD53903B78B5DE6CCC32B78A99F13385B21FE309F6A4B3B55588234DC532D9AC1A651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cursob.exe

File Explorer

cursob.exe

.exe 2.8MB

cursob.exe

IMPHASH dfaae9a8821e1481a8f12b46a7679b86
SHA256 937034bdff45ced5839e1a020fec2761eade8745664db9248784d0eba61fa652
MD5 08621019af5403f0c2f56e94efb7ee54
SHA1 b2cbd100ca4b9a95f1e98b9067d443904786ca47
SHA512 500e8d82a1edce2a8018ec6bfc657153c3ad63914b36e8e26c41b3d6c07f6e7774bda67de000ebddcca0567bec5a3e2178fe7f87fd07a16423dfbbcf941618c8
SSDEEP 49152:5Ix94PLKR0VMC7w0hqLk7JeMk3Ka7NTSYjhklDoR:Thw0hqLk7JeH3FSYjhklDoR
TLSH
T1EAD53903B78B5DE6CCC32B78A99F13385B21FE309F6A4B3B55588234DC532D9AC1A651
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comdlg32

ChooseColorW GetOpenFileNameW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

gdiplus

GdipAddPathArc GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawEllipse GdipDrawImageRect GdipDrawImageRectI GdipDrawLine GdipDrawLineI GdipDrawPath GdipDrawPolygon GdipDrawRectangle GdipDrawRectangleI GdipDrawString GdipFillEllipse GdipFillPath GdipFillPolygon GdipFillRectangle GdipFillRectangleI GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImageWidth GdipGraphicsClear GdipRestoreGraphics GdipRotateWorldTransform GdipSaveGraphics GdipSaveImageToFile GdipSetInterpolationMode GdipSetPenEndCap GdipSetPenLineCap197819 GdipSetPenStartCap GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipTranslateWorldTransform GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CompareFileTime CopyFileW CreateEventA CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LocalFree OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbsrtowcs strtoul

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr roundf

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fileno _read _setmode fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup memset strcmp strlen strncmp wcscmp wcscpy_s wcslen

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoInitializeEx CoUninitialize

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

user32

AdjustWindowRect AppendMenuW BeginPaint ClientToScreen CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DispatchMessageW EndPaint GetClientRect GetCursorPos GetMessageW GetSystemMetrics InvalidateRect LoadCursorW PostQuitMessage RegisterClassW ReleaseCapture ScreenToClient SendMessageW SetCapture SetCursor ShowWindow TrackMouseEvent TrackPopupMenu TranslateMessage UpdateWindow

Name

.text

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

370KB

Virtual Size

369KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cursob.exe

comdlg32

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

shell32

shlwapi

user32

generic