eKWBs

Sharing

Copy URL Twitter E-mail

General

Target
eKWBs
Size 1.3MB
Sample260723-amd41atsat
SHA256 ea41a8f0aa1c0dc365258902bde3e87529e4af2a882b19fb35e3b5584a9832ac
MD5 88576ff9320ae2c6de87dc6082f02527
SHA1 0836c7c544f231d6995f7a87b34b2c8875328b17
SHA512 17501895da0ff329580d7fe4787cb753979e38aeeed67dd0a1ff7a316528cf442c634e0ebf6e95027241d3f4c27b5695bca04e4b1108faf42a3c1edea8426126
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/dcUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4b2UrN
TLSH
T1AF554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eKWBs

File Explorer

eKWBs

.exe 1.3MB

IMPHASH ce12f68deeaf0abadf1d20107ea1a812
SHA256 ea41a8f0aa1c0dc365258902bde3e87529e4af2a882b19fb35e3b5584a9832ac
MD5 88576ff9320ae2c6de87dc6082f02527
SHA1 0836c7c544f231d6995f7a87b34b2c8875328b17
SHA512 17501895da0ff329580d7fe4787cb753979e38aeeed67dd0a1ff7a316528cf442c634e0ebf6e95027241d3f4c27b5695bca04e4b1108faf42a3c1edea8426126
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/dcUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4b2UrN
TLSH
T1AF554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx ReadProcessMemory ResumeThread SetFileCompletionNotificationModes SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualProtectEx VirtualQueryEx WaitForSingleObject WriteConsoleW WriteFileEx WriteProcessMemory DeleteCriticalSection EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtQueryInformationProcess NtQuerySystemInformation NtWriteFile RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

ole32

CoUninitialize

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _fpreset _initterm _onexit _wtoi64 abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf wcslen

Name

.text

Size

851KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eKWBs

kernel32

ntdll

ole32

pdh

powrprof

psapi

shell32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

msvcrt

generic