cum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cum.exe
Size 1.0MB
Sample260809-brfdasfq5y
SHA256 9d53d65249b5e7c8b722daa21ef21e9d1b0d51e0ff65bf792e92edb998a2a0ec
MD5 9076b74d32a0ed91a0f7e91c93729385
SHA1 662c992666bd413de3f7b2812a0ead0386d55cac
SHA512 9494e001ec3816fc79c2b3e4618c28d6e9f9620a9379c77c1c3a05b01a9fbcac1b87430fdc4e126383dc32b5d78bd24742f8aa3a84d77f1a48048de032611750
SSDEEP 24576:HwNzP4TsluDtAsZLsU3wjzT84Gif+O93l0fZl3:HQ0AlwrsUyT+O93+x
TLSH
T195359D17A3A510F9D1A7C179C5528A13F7B2B8691321DBDF03A089791F236E46F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cum.exe

File Explorer

cum.exe

.exe 1.0MB

cum.exe

IMPHASH 4462080d419a369e7580fb2fe31244f2
SHA256 9d53d65249b5e7c8b722daa21ef21e9d1b0d51e0ff65bf792e92edb998a2a0ec
MD5 9076b74d32a0ed91a0f7e91c93729385
SHA1 662c992666bd413de3f7b2812a0ead0386d55cac
SHA512 9494e001ec3816fc79c2b3e4618c28d6e9f9620a9379c77c1c3a05b01a9fbcac1b87430fdc4e126383dc32b5d78bd24742f8aa3a84d77f1a48048de032611750
SSDEEP 24576:HwNzP4TsluDtAsZLsU3wjzT84Gif+O93l0fZl3:HQ0AlwrsUyT+O93+x
TLSH
T195359D17A3A510F9D1A7C179C5528A13F7B2B8691321DBDF03A089791F236E46F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

488872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\etjba\Downloads\Cmd Loader\Cmd Loader\x64\Release\cum.pdb

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

kernel32

HeapSize HeapReAlloc CreateThread HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA VerifyVersionInfoA QueryPerformanceCounter GetTickCount MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx WideCharToMultiByte OutputDebugStringW InitializeCriticalSectionEx HeapFree GetModuleFileNameA Process32Next Process32First CreateToolhelp32Snapshot SetConsoleTitleW GetLocaleInfoEx SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryW LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetWindowsDirectoryW OpenProcess GetCurrentProcess Sleep FindClose FindFirstFileW CreateFileW CloseHandle DeviceIoControl GetStdHandle DeleteFileW ReadFile WriteFile IsDebuggerPresent Beep GetLastError WaitForSingleObject GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

user32

MessageBoxA UnhookWindowsHookEx IsWindowVisible SetWindowsHookExA GetAsyncKeyState EnumWindows GetWindowThreadProcessId GetWindow PostThreadMessageA

advapi32

CryptEncrypt CryptReleaseContext CryptGenRandom GetUserNameA GetTokenInformation GetLengthSid OpenProcessToken IsValidSid CopySid ConvertSidToStringSidA CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptAcquireContextA

shell32

ShellExecuteA ShellExecuteW

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry RtlImageNtHeader

normaliz

IdnToAscii

wldap32

ord33 ord32 ord27 ord26 ord41 ord79 ord45 ord60 ord211 ord46 ord217 ord143 ord35 ord30 ord200 ord301 ord50 ord22

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertFreeCertificateChain PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptStringToBinaryA

ws2_32

setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen bind ioctlsocket htons getsockopt __WSAFDIsSet select getsockname getaddrinfo freeaddrinfo getpeername recvfrom sendto gethostname ntohl ntohs closesocket recv send WSAGetLastError connect

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__std_terminate memset memmove memcpy __C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy memcmp strchr strstr memchr __current_exception __current_exception_context strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invoke_watson strerror terminate abort _resetstkoflw _getpid exit _beginthreadex _errno _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit __sys_nerr _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _get_initial_narrow_environment _initterm _initterm_e _exit system __p___argc __p___argv _c_exit

api-ms-win-crt-string-l1-1-0

_stricmp strpbrk strspn strcpy_s isupper strcmp wcslen strncpy strncmp tolower strlen _strdup strcspn

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode free realloc malloc

api-ms-win-crt-stdio-l1-1-0

feof fputc __p__commode fread fseek _popen __stdio_common_vsscanf _write _close _open _set_fmode fsetpos fputs _get_stream_buffer_pointers fopen _fseeki64 fwrite setvbuf fgetpos ftell __stdio_common_vsprintf fgetc ungetc fgets _pclose __acrt_iob_func fflush __stdio_common_vfprintf fclose _lseeki64 _read

api-ms-win-crt-filesystem-l1-1-0

remove _unlock_file _access _unlink _fstat64 _lock_file _stat64

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 _time64

api-ms-win-crt-convert-l1-1-0

strtoll strtod atoi strtol strtoull strtoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass