5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3

Sharing

Copy URL Twitter E-mail

General

Target
5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3
Size 465KB
Sample260724-cjmcba1dpc
SHA256 5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3
MD5 37d1e2644b2c145e264913ac6575e9ec
SHA1 4da5e14760e3002df9108abfc6c8bbdbff887233
SHA512 caaf6a829def8d8f028b87f970fbad5a519bd58200f9c0b4b5073601f70964761e11db369aa50fb69cf0d7b174a74142dba71dfe61a0f4b0086690cf965a138c
SSDEEP 12288:o6nG7dtBbUcUJj34D5lkC+Aj2XPCcaHEzP6SBDTImHv:1n87BE74D5lkC+Aj2XPCcaHO5BDLHv
TLSH
T1F3A45CC2652BE0BBC95FA1B5E084B23EF75C816047984EE38224DDB6587DED118F4B39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3

File Explorer

5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3

.dll 465KB

5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3

IMPHASH a4175e48024ac3dc9d6062fc015b129f
SHA256 5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3
MD5 37d1e2644b2c145e264913ac6575e9ec
SHA1 4da5e14760e3002df9108abfc6c8bbdbff887233
SHA512 caaf6a829def8d8f028b87f970fbad5a519bd58200f9c0b4b5073601f70964761e11db369aa50fb69cf0d7b174a74142dba71dfe61a0f4b0086690cf965a138c
SSDEEP 12288:o6nG7dtBbUcUJj34D5lkC+Aj2XPCcaHEzP6SBDTImHv:1n87BE74D5lkC+Aj2XPCcaHO5BDLHv
TLSH
T1F3A45CC2652BE0BBC95FA1B5E084B23EF75C816047984EE38224DDB6587DED118F4B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

378773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\project\itunesproto\build\vs2017-ollvm\..\..\output\v141\x86\Release\iCloudKeybag.pdb

kernel32

AreFileApisANSI CloseHandle CreateEventW CreateFileW DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileExW FindNextFileW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadContext InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleBaseNameA LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter ResetEvent ResumeThread RtlCaptureStackBackTrace SetEvent SetLastError SetThreadContext SetUnhandledExceptionFilter SuspendThread TerminateProcess UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObjectEx WideCharToMultiByte

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Syserror_map@std@@YAPBDH@Z ?_Throw_C_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPADK@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uncaught_exception@std@@YA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z _Mtx_destroy_in_situ _Mtx_init_in_situ _Mtx_lock _Mtx_unlock

spdlogcore

?InitSpdLogA@@YAXPBD0@Z ?SpdLogA@@YAXPBDHH0ZZ

shlwapi

PathFileExistsA PathFindFileNameA PathFindFileNameW PathRemoveFileSpecA PathRemoveFileSpecW

dbghelp

MakeSureDirectoryPathExists

vcruntime140

_CxxThrowException __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_destroy_list _except_handler3 _except_handler4_common _purecall memchr memcmp memcpy memmove memset

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

_cexit _configure_narrow_argv _crt_atexit _execute_onexit_table _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _seh_filter_dll exit terminate

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vswprintf fclose fopen fread

api-ms-win-crt-string-l1-1-0

strcmp strlen tolower wcslen

Name

.text

Size

367KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5003c52da7561306c72bdf855005a4116f06dbd6c1d7c0b83a50db2701d583c3

kernel32

msvcp140

spdlogcore

shlwapi

dbghelp

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic