Undetected_code dumper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Undetected_code dumper.exe
Size 1.2MB
Sample261104-3xccdaet2s
SHA256 c654d94e193f7802942d6f73d40d2ee86d1eccff80b1d8c5efc282996be58938
MD5 8e05f993450e4e111806b7cc19fc0e68
SHA1 cd45c6f232f69648310609b094744fdfb1fd5536
SHA512 90341ef28091ce921ca5c0187fa31bdc8560a938d148e62e5f47074fbc028f93fb7db59ba7c1fb603cd061ede7106c8092146ed96dfb63515ac5084e1119b561
SSDEEP 24576:7/bxx4b4enqLKb5V7KzZ8SY88STgNhSW9244paMAsBA:fxxYnqLKb5V7K98L88U
TLSH
T1F7558D6D65A811F8C16BC0B8CF9B1A53FB32B4490334AAF715D9C2661F27EF45A3DA10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Undetected_code dumper.exe

File Explorer

Undetected_code dumper.exe

.exe 1.2MB

Undetected_code dumper.exe

IMPHASH a5b0263c41cb88849179d095c6b19323
SHA256 c654d94e193f7802942d6f73d40d2ee86d1eccff80b1d8c5efc282996be58938
MD5 8e05f993450e4e111806b7cc19fc0e68
SHA1 cd45c6f232f69648310609b094744fdfb1fd5536
SHA512 90341ef28091ce921ca5c0187fa31bdc8560a938d148e62e5f47074fbc028f93fb7db59ba7c1fb603cd061ede7106c8092146ed96dfb63515ac5084e1119b561
SSDEEP 24576:7/bxx4b4enqLKb5V7KzZ8SY88STgNhSW9244paMAsBA:fxxYnqLKb5V7K98L88U
TLSH
T1F7558D6D65A811F8C16BC0B8CF9B1A53FB32B4490334AAF715D9C2661F27EF45A3DA10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1035344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\usv2\Downloads\supQdumper\SupQdumper\build\Undetected_code dumper.pdb

kernel32

SetConsoleTextAttribute GetStdHandle SetConsoleMode GetConsoleMode GetModuleHandleA Sleep GetProcAddress WideCharToMultiByte GetModuleFileNameA SetConsoleCtrlHandler SetConsoleTitleA GetLastError MoveFileExA DeleteFileA CloseHandle CreateDirectoryA IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive

user32

MessageBoxA

zydis

ZydisCalcAbsoluteAddress ZydisRegisterGetLargestEnclosing ZydisFormatterFormatInstruction ZydisMnemonicGetString ZydisFormatterInit ZydisDecoderDecodeFull ZydisDecoderDecodeInstruction ZydisDecoderInit

msvcp140

?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock _Query_perf_frequency ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Query_perf_counter ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset __current_exception __current_exception_context memcpy _CxxThrowException memcmp strrchr __C_specific_handler __std_exception_copy __std_exception_destroy __std_terminate

api-ms-win-crt-stdio-l1-1-0

fopen fflush __stdio_common_vsprintf_s fclose fgetc __p__commode _isatty _fileno getchar fputc fwrite fopen_s _set_fmode _get_stream_buffer_pointers __stdio_common_vfprintf __acrt_iob_func _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-string-l1-1-0

strnlen isalpha strcmp _stricmp isalnum tolower toupper isxdigit strlen

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s

api-ms-win-crt-convert-l1-1-0

strtol atoi strtoul strtoll strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _beginthreadex terminate __p___argv _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

log __setusermatherr ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale