CEH[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CEH.exe
Size 4.1MB
Sample260919-styfbsxw4l
SHA256 1d4e50774943b44c0797284d7a01498a8cfeedda65a014ee33ea2333865ed937
MD5 7a2744e395cb59da73de98fafe11a997
SHA1 c2cfefa4771ac3c3190ea42d9b49f143f98e669c
SHA512 199ddabea3a21f29b1844d89ffb807598c5d84c026d44b1946cce17591c47b66535dc784cab3ea2a15151ce2fd6f743561c01246ec113c5f8d1f2d70e2914a23
SSDEEP 49152:26PxsdeUu+YkL3OvK2f5Y3QAcFxqyBnbNuzfe3LJrWYt08WMW8:DiIUFYfTa3MFuurWM/
TLSH
T11C16BE427832C8E2C54501B5A8673F875D6C4A30C3D46CD7A3D60E9496E62F2B6AFB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CEH.exe

File Explorer

CEH.exe

.exe 4.1MB

CEH.exe

IMPHASH 4a10b569c3bc9bbe489edc78715d4c10
SHA256 1d4e50774943b44c0797284d7a01498a8cfeedda65a014ee33ea2333865ed937
MD5 7a2744e395cb59da73de98fafe11a997
SHA1 c2cfefa4771ac3c3190ea42d9b49f143f98e669c
SHA512 199ddabea3a21f29b1844d89ffb807598c5d84c026d44b1946cce17591c47b66535dc784cab3ea2a15151ce2fd6f743561c01246ec113c5f8d1f2d70e2914a23
SSDEEP 49152:26PxsdeUu+YkL3OvK2f5Y3QAcFxqyBnbNuzfe3LJrWYt08WMW8:DiIUFYfTa3MFuurWM/
TLSH
T11C16BE427832C8E2C54501B5A8673F875D6C4A30C3D46CD7A3D60E9496E62F2B6AFB3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

575406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptReleaseContext OpenServiceA QueryServiceStatusEx CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash OpenSCManagerA RegQueryValueExA CloseServiceHandle RegCloseKey CryptAcquireContextA CryptEncrypt CryptImportKey CryptDestroyKey CryptGenRandom

ws2_32

getsockopt getsockname htons select closesocket __WSAFDIsSet ntohs setsockopt WSAIoctl bind freeaddrinfo accept send listen recvfrom sendto ioctlsocket gethostname htonl ntohl WSASetLastError recv getaddrinfo socket connect getpeername WSAGetLastError WSACleanup WSAStartup

crypt32

CertFreeCertificateContext

wldap32

ord41 ord50 ord60 ord211 ord46 ord143 ord301 ord200 ord30 ord79 ord35 ord22 ord33 ord32 ord27 ord26

normaliz

IdnToAscii

d3d9

Direct3DCreate9

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExpandEnvironmentStringsA AcquireSRWLockExclusive PeekNamedPipe ReadFile GetStartupInfoW GetModuleHandleW GetFileType GetStdHandle WaitForSingleObjectEx FormatMessageA VerifyVersionInfoA GetSystemDirectoryA ReleaseSRWLockExclusive WakeAllConditionVariable IsDebuggerPresent SleepConditionVariableSRW SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetTickCount64 QueryPerformanceCounter FreeLibrary VerSetConditionMask IsDBCSLeadByte QueryPerformanceFrequency GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetLocaleInfoA WaitForMultipleObjects GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc OutputDebugStringA GetModuleFileNameA SizeofResource Process32First GetFileAttributesExA WriteProcessMemory GetCurrentProcess TerminateProcess Thread32Next GetFullPathNameA Thread32First FindResourceA GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetTempPathA K32GetModuleFileNameExA GetFileAttributesA LoadLibraryA LockResource DeleteFileA Process32Next CloseHandle K32GetModuleBaseNameA LoadResource QueueUserAPC GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread CreateProcessA GetSystemTimeAsFileTime K32EnumProcessModules CreateDirectoryA VirtualFreeEx OpenThread

user32

GetKeyboardLayout GetDC ClientToScreen GetForegroundWindow GetKeyState TrackMouseEvent LoadCursorA GetCapture SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetMessageExtraInfo SetCursorPos ReleaseDC UpdateWindow PostQuitMessage PeekMessageA GetClientRect LoadIconA TranslateMessage SetLayeredWindowAttributes MessageBoxA ShowWindow GetActiveWindow RegisterClassExW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW PostMessageA SetWindowPos DestroyWindow GetWindowRect DispatchMessageA MonitorFromPoint DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

_Thrd_detach _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140

_except_handler4_common __current_exception_context __current_exception _CxxThrowException memchr strstr memmove memcpy strchr strrchr __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fwrite ferror feof __stdio_common_vsprintf __stdio_common_vfscanf _lseeki64 fputc fread __acrt_iob_func fflush _set_fmode _wfopen __stdio_common_vsscanf fclose fgets __p__commode fopen fputs ftell _read _write _close _open fseek

api-ms-win-crt-runtime-l1-1-0

_controlfp_s _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm strerror __sys_nerr _getpid _get_narrow_winmain_command_line _beginthreadex _set_app_type _seh_filter_exe _cexit _errno terminate system _crt_atexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

tolower _strdup isgraph wcscat_s _stricmp isprint islower isupper isalnum strncpy isspace isdigit strpbrk isxdigit isalpha strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh calloc malloc free

api-ms-win-crt-convert-l1-1-0

atol strtoul strtol atoi strtoll

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

ceil _libm_sse2_sin_precise _CIfmod _libm_sse2_acos_precise __setusermatherr _libm_sse2_sqrt_precise _libm_sse2_cos_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale