stub[.]bin | Triage™

General

Target
stub.bin
Size 845KB
Sample260916-rc2wrazshs
SHA256 ded080d8d1fb4c816e3f50df967595e3271252cd31aa9bef64272e2a905d4bd4
MD5 0846b85e15ce44ae29d9910272185546
SHA1 bdb4ef5f2d5e9b2e69330cd054239593007222d2
SHA512 287a9831ad7f74b54645f9b1724ecc2bf9cb37f622179d025d8506a6e4be551e9ee68aeeea0a217396a75d345cceaf039658e18a738595d6cab58830826ac6a0
SSDEEP 12288:QMRfGw/SlksT/oV/TrrO2hDIi7KX8IYn3ASTH7dD/Y0S/mokybzUSDiSaYK+b4:QtwltHO2sowqdrYf/vUSEYl4
TLSH
T1B705E125765CE2DAD80D8531C44065F9C632BC10C220ADEB7ACD3F5B3DF36927639AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stub.bin

File Explorer

stub.bin

.exe 845KB

stub.bin

IMPHASH ba790cb1a6dc521a91ecbed5c1f3a21c
SHA256 ded080d8d1fb4c816e3f50df967595e3271252cd31aa9bef64272e2a905d4bd4
MD5 0846b85e15ce44ae29d9910272185546
SHA1 bdb4ef5f2d5e9b2e69330cd054239593007222d2
SHA512 287a9831ad7f74b54645f9b1724ecc2bf9cb37f622179d025d8506a6e4be551e9ee68aeeea0a217396a75d345cceaf039658e18a738595d6cab58830826ac6a0
SSDEEP 12288:QMRfGw/SlksT/oV/TrrO2hDIi7KX8IYn3ASTH7dD/Y0S/mokybzUSDiSaYK+b4:QtwltHO2sowqdrYf/vUSEYl4
TLSH
T1B705E125765CE2DAD80D8531C44065F9C632BC10C220ADEB7ACD3F5B3DF36927639AA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ioncyuintz.pdb

kernel32

CreateFileW GetLastError SetFileTime CloseHandle GetFullPathNameW SetLastError IsProcessorFeaturePresent GetActiveProcessorCount GetCurrentProcessorNumber GetOEMCP GetProcessHeap HeapReAlloc GetActiveProcessorGroupCount SetFilePointerEx GetACP GetMaximumProcessorCount GetVersion SetFileInformationByHandle GetFileAttributesW GetLogicalDriveStringsW GetDriveTypeW GetThreadId IsThreadAFiber GetProcAddress GetFileType GetCPInfo GetConsoleCP GetSystemInfo GetStdHandle GetConsoleWindow GetFileInformationByHandle GetFileInformationByHandleEx WriteConsoleW GetConsoleOutputCP TryAcquireSRWLockExclusive GetConsoleMode ReleaseSRWLockExclusive HeapFree GetNativeSystemInfo GetLogicalDrives LoadLibraryA HeapAlloc GetUserDefaultUILanguage GetCurrentThread GetUserDefaultLCID GetThreadLocale FlushFileBuffers HeapSize LCMapStringW CompareStringW GetModuleHandleA MultiByteToWideChar IsValidCodePage WaitForSingleObject QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect WriteFile

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

user32

GetMessageExtraInfo GetShellWindow GetFocus GetDesktopWindow GetForegroundWindow

winmm

midiOutGetNumDevs midiInGetNumDevs joyGetNumDevs

Sharing