h5bf0f2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
h5bf0f2.exe
Size 106KB
Sample261014-2wpqmsa12k
SHA256 a923ae1ecdd0a7da99f02a873a9c2986d63e7a967312482d4d9343e3be53958b
MD5 8b098d61ad61158558e0bdba57cd98de
SHA1 311aecf3b190d06707b48622307b5ce1cc4eadd2
SHA512 143d6c4c639a21fff0b184c592502bd68381611f7d791da5bc0e6725827420f194c6b1a1730ac33b21e7848ae1de89aea984ed17a140b1b5ddbab8a21d98dfdb
SSDEEP 768:j+YRG0bI66P7PQLy8ZXRz/Z6yD39Z3oroPDoirLMXk583luPmbgF3AjhBaOAAA9P:6YRCP7PQhlR7EyD39ZGysA8pWkBw
TLSH
T1A0B36B1A7E5921F6D8B6C038DC9A1226F5B1709817361FCF12845AB96F312ECB83E7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
h5bf0f2.exe

File Explorer

h5bf0f2.exe

.exe 106KB

h5bf0f2.exe

IMPHASH 27b1fd37cfb8a4a044407c13638bfab9
SHA256 a923ae1ecdd0a7da99f02a873a9c2986d63e7a967312482d4d9343e3be53958b
MD5 8b098d61ad61158558e0bdba57cd98de
SHA1 311aecf3b190d06707b48622307b5ce1cc4eadd2
SHA512 143d6c4c639a21fff0b184c592502bd68381611f7d791da5bc0e6725827420f194c6b1a1730ac33b21e7848ae1de89aea984ed17a140b1b5ddbab8a21d98dfdb
SSDEEP 768:j+YRG0bI66P7PQLy8ZXRz/Z6yD39Z3oroPDoirLMXk583luPmbgF3AjhBaOAAA9P:6YRCP7PQhlR7EyD39ZGysA8pWkBw
TLSH
T1A0B36B1A7E5921F6D8B6C038DC9A1226F5B1709817361FCF12845AB96F312ECB83E7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70242

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lukas\source\repos\injector\x64\Debug\injector.pdb

kernel32

GetStdHandle GetFileAttributesA GetFullPathNameA CloseHandle GetLastError WaitForSingleObject Sleep CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress MultiByteToWideChar WideCharToMultiByte SetConsoleOutputCP SetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleTitleA CreateToolhelp32Snapshot Process32First Process32Next GetCurrentThreadId FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc IsDebuggerPresent RaiseException QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

vcruntime140d

__vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW __current_exception_context __current_exception __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler strrchr memcpy __vcrt_LoadLibraryExW

ucrtbased

_initterm_e exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _get_initial_narrow_environment _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s _initialize_narrow_environment _seh_filter_exe _CrtDbgReport __stdio_common_vfprintf fflush __acrt_iob_func system strcmp strncpy_s wcslen _configure_narrow_argv _initterm __setusermatherr _initialize_onexit_table _set_app_type _CrtDbgReportW

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

801B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

h5bf0f2.exe

kernel32

ole32

vcruntime140d

ucrtbased

generic