1-de[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1-de.bin
Size 819KB
Sample220424-ecsa4acbfm
SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
MD5 865a58f7fc861377f98d933165690110
SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
SSDEEP 12288:afwXWlMBFs8/JzmwOaRMQvNAY1SyuoXpwzhIq91eN:AwXWiBFs8/JzmwOgd71SBSG6UE
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

1-de.bin

.exe 819KB

1-de.bin

IMPHASH 38a25833a25243bb4efb7354bb15cf71
SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
MD5 865a58f7fc861377f98d933165690110
SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
SSDEEP 12288:afwXWlMBFs8/JzmwOaRMQvNAY1SyuoXpwzhIq91eN:AwXWiBFs8/JzmwOgd71SBSG6UE
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

319720

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapSize OpenMutexW CreateProcessW WaitForSingleObject CreateMutexW GetModuleFileNameW Sleep GetProcessHeap HeapAlloc GetLastError HeapFree GetLogicalDrives MoveFileExW SetFilePointerEx GetConsoleMode GetConsoleCP SetFileAttributesW GetFileAttributesW FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetFileSizeEx ReadFile CloseHandle CreateFileW WriteFile GetCommandLineA GetOEMCP MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW FormatMessageW RtlPcToFileHeader EncodePointer DecodePointer RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress DuplicateHandle WaitForSingleObjectEx GetCurrentProcess GetCurrentThread GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess SetEvent ResetEvent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwindEx SetEnvironmentVariableW ExitProcess GetStdHandle GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType GetTimeZoneInformation IsValidCodePage GetACP WriteConsoleW

advapi32

CryptImportKey CryptEncrypt CryptDuplicateKey CryptReleaseContext CryptGenKey CryptExportKey CryptAcquireContextW RegOpenKeyExW RegDeleteValueW RegCreateKeyA RegCloseKey RegQueryValueExA RegSetValueExW RegSetValueExA RegOpenKeyExA CryptDestroyKey

shell32

SHEmptyRecycleBinW

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

IcmpCloseHandle GetAdaptersInfo IcmpCreateFile IcmpSendEcho

ws2_32

inet_addr