anubis-windows-amd64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
anubis-windows-amd64.zip
Size 7.9MB
Sample261030-vb93hsdw5v
SHA256 c4b58f8192ee4b61b1837da108253ed1406c433d5c9d335d44dfb9878aafbb77
MD5 f5dd0ce260864516fa84988dd987c885
SHA1 09926f174e50b1860f26274a3cd88cf682fbdee1
SHA512 ef91c1cef583bfd21a01e69a5cd36272918755ac8706d54f324c919f8a815381760517d05d5b9f1bd5d62b91ca5a4dfa7f4d21353213cf2d451ea865d2792388
SSDEEP 196608:/G/UVzth6cxy82E2vWJ5kMxwdFf2b9t7ABRUZWXTN/GVekSE0I:eKz2gN5kMOrfC7S6WXFoL
TLSH
T1598633C94D7D9B572F82BA5D0C4916D31FBD889A87F10B8D3283517B202BD2EA432776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/anubis-windows-amd64.exe

File Explorer

anubis-windows-amd64.zip

.zip 7.9MB
anubis-windows-amd64.exe

.exe 21.0MB

anubis-windows-amd64.zip

SHA256 c4b58f8192ee4b61b1837da108253ed1406c433d5c9d335d44dfb9878aafbb77
MD5 f5dd0ce260864516fa84988dd987c885
SHA1 09926f174e50b1860f26274a3cd88cf682fbdee1
SHA512 ef91c1cef583bfd21a01e69a5cd36272918755ac8706d54f324c919f8a815381760517d05d5b9f1bd5d62b91ca5a4dfa7f4d21353213cf2d451ea865d2792388
SSDEEP 196608:/G/UVzth6cxy82E2vWJ5kMxwdFf2b9t7ABRUZWXTN/GVekSE0I:eKz2gN5kMOrfC7S6WXFoL
TLSH
T1598633C94D7D9B572F82BA5D0C4916D31FBD889A87F10B8D3283517B202BD2EA432776
MD5 SHA1 SHA512 SSDEEP TLSH

anubis-windows-amd64.exe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 a1740efd7e7e1cdd1a92876a6c776c9d0e61e6319c9f7450ffafa2ddc78c15b2
MD5 d672d5525bcefa1e9bcefaee49dfcab4
SHA1 4c9f2f0080a35c2d1670284301cf827d494b0b15
SHA512 8012ef8e2b899ea4697fae8f5410997338549ec07c53aa93a0e8e5d9673aa2f423c416a56725196234a5aa063412d0962905ae35386a13ee2f51862ce081e61b
SSDEEP 196608:Jz664NsRUgSFcS/44UkNNC2iGX37p1S4bdY8ypbxI1Kb4v0Q:k6EgUg2Q45UGXr2
TLSH
T1F8274943F86A58E6D0ADD130857392127B717C598B3023D76F60B6202F7BBD4AEBA744
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

589664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

576KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

anubis-windows-amd64.zip

anubis-windows-amd64.exe

kernel32

generic