XUM_build[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XUM_build.zip
Size 15KB
Sample261108-mrpshszves
SHA256 d66625f986e502c7f3401ad4a6d9132260076257d7599d3379c27488c10abd71
MD5 0aa26f9765e2af0ce17f8770569a8d4a
SHA1 45bcfd8c6b8521560f77ae4678c7ce6b87f088e8
SHA512 8b29f44039ee279c3d7a299e08daed18a43fc8559d32ec5435eb092d6d6472b3adc8a9e3293d15d8967ac7f24d3e4667e717be20f7a7d5c4fa0559a5a43415e5
SSDEEP 384:EgqOLXpf5emi2vlaZUgX+eSvuKp4B12/tlUG:K2Zf5ZtwX/G
TLSH
T14662CFBFBDA67C38D94124D50AF4A724427653F6081CC2C0FE6DE8AA67312BD9BA15C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XUM.exe

File Explorer

XUM_build.zip

.zip .js 15KB
XUM.exe

.exe .ps1 29KB

XUM_build.zip

SHA256 d66625f986e502c7f3401ad4a6d9132260076257d7599d3379c27488c10abd71
MD5 0aa26f9765e2af0ce17f8770569a8d4a
SHA1 45bcfd8c6b8521560f77ae4678c7ce6b87f088e8
SHA512 8b29f44039ee279c3d7a299e08daed18a43fc8559d32ec5435eb092d6d6472b3adc8a9e3293d15d8967ac7f24d3e4667e717be20f7a7d5c4fa0559a5a43415e5
SSDEEP 384:EgqOLXpf5emi2vlaZUgX+eSvuKp4B12/tlUG:K2Zf5ZtwX/G
TLSH
T14662CFBFBDA67C38D94124D50AF4A724427653F6081CC2C0FE6DE8AA67312BD9BA15C4
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

XUM.exe

IMPHASH de79404feb0b2a0fee90ee0f22234077
SHA256 2402504638bd9cb8348c63a6cc2ee807c2ec2c2d12046e5899197b354e5ea66b
MD5 b97cb4f5bad1f938422cdb80b89277f9
SHA1 a49b8a6b1545fb5e33c774a20ca9c2db176b79c7
SHA512 bb9db104df43fedbd783d0089a5fe68b9ab580791e532a700816eb760a2c4df60dbd0193948ab7c5a81776ae39010974b4e1df09d16d777465da3239a9a8a661
SSDEEP 384:Aacn5dMuQT2A+mX6io5K4ErA8Dy+XgicYxzLUKfNMFDVQZYg4:Aacn9AFIKlrAJgcYxlNUDGZYg
TLSH
T125D25D5BA2D514EDC03BC1398A179D46E67270A55B50EFEB03A081F61EA2BD07F3D5C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetLastError HeapAlloc HeapFree GetProcessHeap GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree FreeLibrary GetProcAddress LoadLibraryA IsBadReadPtr IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ

wininet

InternetOpenA

vcruntime140

__std_exception_copy __std_exception_destroy __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcpy memset memmove

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _initterm _initialize_onexit_table _cexit _crt_atexit terminate _initialize_narrow_environment _configure_narrow_argv system _invoke_watson _set_app_type _register_onexit_function _seh_filter_exe _exit _get_narrow_winmain_command_line

api-ms-win-crt-heap-l1-1-0

realloc _callnewh malloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale