pubky-node[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pubky-node.exe
Size 11.0MB
Sample261107-1stdzs116q
SHA256 519f434ba68e04887e2b17fb8707ddefa1703d721536b5627406974837d18698
MD5 d96751a39dc061f8a9da5fab796ab93f
SHA1 0f81e6c3de9f2e4554ada5b53d372b9f89300305
SHA512 bbd277b744faf929382a9d945b5377bcc95e5834031b7aadee4dc78be68775fe3020c4114ae9a401bd408b1a29e3bdb6568ce15b2667c9f946ea9128d3b6317d
SSDEEP 98304:Ea2w7wzu0vGXYghAwHZG+NEpYo17xAb+R7lajxH:lgEy
TLSH
T15CC627217B9A98ACC05AC47493468A725A7130CB0B39B9FF44D886793F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pubky-node.exe

File Explorer

pubky-node.exe

.exe 11.0MB

pubky-node.exe

IMPHASH 668d7ab52ec51c1d3f31ece564d6769e
SHA256 519f434ba68e04887e2b17fb8707ddefa1703d721536b5627406974837d18698
MD5 d96751a39dc061f8a9da5fab796ab93f
SHA1 0f81e6c3de9f2e4554ada5b53d372b9f89300305
SHA512 bbd277b744faf929382a9d945b5377bcc95e5834031b7aadee4dc78be68775fe3020c4114ae9a401bd408b1a29e3bdb6568ce15b2667c9f946ea9128d3b6317d
SSDEEP 98304:Ea2w7wzu0vGXYghAwHZG+NEpYo17xAb+R7lajxH:lgEy
TLSH
T15CC627217B9A98ACC05AC47493468A725A7130CB0B39B9FF44D886793F79AF51F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8032284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pubky_node.pdb

bcryptprimitives

ProcessPrng

kernel32

WaitForSingleObject CreateMutexA CreateEventA GetCurrentProcessId CreateThread GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree OpenProcess UnlockFile OpenMutexA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetFilePointer SetEndOfFile LockFileEx LockFile GetFileSize GetFileInformationByHandle lstrlenW RtlVirtualUnwind QueryPerformanceCounter QueryPerformanceFrequency GetSystemInfo GetVersion VirtualAlloc MapViewOfFileEx UnmapViewOfFile GetQueuedCompletionStatusEx FormatMessageA CreateFileMappingA MultiByteToWideChar CancelIoEx GetProcessHeap HeapFree HeapReAlloc WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult CreateDirectoryW GetFileInformationByHandleEx SetFileCompletionNotificationModes SwitchToThread GetFinalPathNameByHandleW FindFirstFileExW FindClose GetFileType CreateIoCompletionPort GetFullPathNameW GetTempPathW GetModuleFileNameW FormatMessageW ExitProcess ReadFileEx SleepEx SetHandleInformation IsProcessorFeaturePresent HeapAlloc WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime GetExitCodeProcess GetProcessId TerminateProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimeAsFileTime InitializeSListHead RegisterWaitForSingleObject DuplicateHandle GetCurrentProcess SetConsoleCtrlHandler UnregisterWaitEx SetNamedPipeHandleState SetConsoleMode GetConsoleMode CreateFileW IsDebuggerPresent UnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep GetLastError CloseHandle ReleaseMutex GetModuleHandleW SetUnhandledExceptionFilter

ws2_32

getaddrinfo WSAGetLastError socket WSAStartup WSACleanup freeaddrinfo shutdown listen bind WSASocketW sendto connect ioctlsocket setsockopt send WSASend recv getpeername accept getsockname recvfrom getsockopt closesocket WSAIoctl

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

NtCreateNamedPipeFile NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtCancelIoFileEx NtOpenFile NtReadFile

advapi32

SystemFunction036 InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

vcruntime140

__current_exception memcmp memset memcpy __CxxFrameHandler3 _CxxThrowException __current_exception_context memmove __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen strncmp _strdup wcscpy

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode free realloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _initterm_e _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _get_initial_narrow_environment _initialize_narrow_environment __p___argc exit strerror _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _initterm _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale