2fe88f56440859514b455db6f900804ce76ff0fa01699b52902171462ae70f01[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target
2fe88f56440859514b455db6f900804ce76ff0fa01699b52902171462ae70f01.bin.sample.gz
Size 134KB
Sample220602-sq6yasgfh6
SHA256 c5c9224ea3dc0598b4e0b14fc90794a543c52694153a7d3424797afaf09d6dac
MD5 41f40140648a26762eda469e093d7dc0
SHA1 da1b1fd7eddf51d1fe2e6ffe3baacf9cad9fd169
SHA512 3e3e18fccbc09c05117d7c382aef9f89e3f609ad473f906d81a9d2058d7f23c0d04cfae2375516544d20c58bb9ab8e39682a6671fd93621cbf2b6b24ede9598e
SSDEEP 3072:+rmiDARttXCLI3UgjLJj4UF57sbyiYfYXma0jhbC9OO0LPbTg:5tSLIjGS7sbyiYfwmaehuQ5TTg
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

2fe88f56440859514b455db6f900804ce76ff0fa01699b52902171462ae70f01.bin.sample.gz

.gz 134KB
sample

.exe 221KB

2fe88f56440859514b455db6f900804ce76ff0fa01699b52902171462ae70f01.bin.sample.gz

SHA256 c5c9224ea3dc0598b4e0b14fc90794a543c52694153a7d3424797afaf09d6dac
MD5 41f40140648a26762eda469e093d7dc0
SHA1 da1b1fd7eddf51d1fe2e6ffe3baacf9cad9fd169
SHA512 3e3e18fccbc09c05117d7c382aef9f89e3f609ad473f906d81a9d2058d7f23c0d04cfae2375516544d20c58bb9ab8e39682a6671fd93621cbf2b6b24ede9598e
SSDEEP 3072:+rmiDARttXCLI3UgjLJj4UF57sbyiYfYXma0jhbC9OO0LPbTg:5tSLIjGS7sbyiYfwmaehuQ5TTg
MD5 SHA1 SHA512 SSDEEP

sample

IMPHASH cbd5f9d3d5116a19f639b439cc5737cd
SHA256 2fe88f56440859514b455db6f900804ce76ff0fa01699b52902171462ae70f01
MD5 f50aee96d5c602eaa9e8e54e927b79d5
SHA1 0fc845ec30b3c3ed755f5c6b17dfb2378e8bf954
SHA512 a941eeecaa8a3409ecdb46ab6f5ca55a6b158d2260dc7b62aaeec147200c4df4cf9e1ea6b13798e59c771540afde52b4a779b595b1fd316e40f1f511aa372c37
SSDEEP 6144:w0i0DpqSlqqDLPyOxODvcDjoG1oPKajg3GqVmnO76k5:w0i0DpqBqnecDjoGyPKaE3Dd7X5
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

176213

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA Process32FirstW RemoveDirectoryW QueryDosDeviceW Process32NextW FindNextFileW VirtualProtect CreateToolhelp32Snapshot GetFileTime ReleaseMutex FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW DeleteFileW GetFileInformationByHandle LocalFree GetSystemTime WriteProcessMemory SetFileAttributesW CreateThread ExpandEnvironmentStringsW SetThreadPriority lstrcmpiA SetHandleInformation CreatePipe SetEvent OpenEventW GetCurrentThreadId TlsSetValue TerminateProcess ResetEvent FindClose UnmapViewOfFile CreateFileMappingW TlsAlloc TlsFree GetNativeSystemInfo GetVersionExW WTSGetActiveConsoleSessionId GlobalLock GlobalUnlock MoveFileExW GetCommandLineW SetErrorMode GetComputerNameW DuplicateHandle GetCurrentProcessId GetPrivateProfileStringW GetPrivateProfileIntW CreateRemoteThread GetModuleHandleA GetUserDefaultUILanguage GetFileAttributesW lstrcpynW HeapCreate HeapDestroy ReadProcessMemory Sleep LoadLibraryW WideCharToMultiByte Thread32First VirtualAllocEx VirtualProtectEx SetLastError GetLastError OpenMutexW GetFileSizeEx GetTempPathW FlushFileBuffers lstrlenW MultiByteToWideChar CreateFileW GetTimeZoneInformation ReadFile MapViewOfFile Thread32Next OpenProcess WriteFile VirtualQueryEx SetFileTime IsBadReadPtr GetProcessHeap VirtualFree GetCurrentThread CreateDirectoryW HeapFree GetLogicalDriveStringsW SetFilePointerEx GetCurrentProcess SystemTimeToFileTime HeapAlloc CreateProcessW FreeLibrary SetEndOfFile FindFirstFileW CreateMutexW HeapReAlloc WaitForSingleObject GetTempFileNameW FileTimeToDosDateTime GetEnvironmentVariableW lstrcmpiW GetProcAddress GetModuleFileNameW GetModuleHandleW GetFileAttributesExW GetProcessId EnterCriticalSection VirtualAlloc LeaveCriticalSection VirtualFreeEx InitializeCriticalSection SetThreadContext GetThreadContext ExitProcess CloseHandle WaitForMultipleObjects CreateEventW GetLocalTime ExitThread GetTickCount TlsGetValue

user32

CreateDesktopW SetProcessWindowStation GetThreadDesktop CloseWindowStation CreateWindowStationW GetProcessWindowStation OpenDesktopW CloseDesktop SetThreadDesktop GetUserObjectInformationW OpenWindowStationW CharLowerBuffA GetTopWindow LoadImageW WindowFromPoint IsRectEmpty CharToOemW GetWindowLongW CharLowerA CharUpperW SetWindowLongW SendMessageTimeoutW GetWindow DispatchMessageW GetMenuState GetMessageA GetUpdateRgn GetMessageW RegisterClassExA GetWindowDC SetCapture SendMessageW PrintWindow EqualRect PostThreadMessageW IntersectRect DrawEdge GetWindowInfo PostMessageW GetSystemMetrics MessageBoxA GetKeyboardLayoutList MapVirtualKeyW GetKeyboardState ToUnicode GetWindowRect GetParent GetClassLongW GetAncestor SetWindowPos IsWindow MapWindowPoints ExitWindowsEx RegisterWindowMessageW GetMenuItemID SetKeyboardState GetSubMenu MenuItemFromPoint GetMenuItemRect GetMenu TrackPopupMenuEx SystemParametersInfoW CharLowerW GetClassNameW DefDlgProcW DefFrameProcA OpenInputDesktop GetMenuItemCount HiliteMenuItem EndMenu GetWindowThreadProcessId GetShellWindow DrawIcon BeginPaint GetUpdateRect GetDC GetCapture TranslateMessage RegisterClassExW SetCursorPos GetClipboardData PeekMessageW GetDCEx PeekMessageA ReleaseDC DefWindowProcA GetCursorPos DefMDIChildProcW SwitchDesktop DefDlgProcA DefMDIChildProcA GetIconInfo EndPaint FillRect ReleaseCapture RegisterClassW CallWindowProcA CallWindowProcW DefWindowProcW GetMessagePos DefFrameProcW RegisterClassA MsgWaitForMultipleObjects

advapi32

CreateProcessAsUserA CreateProcessAsUserW CryptGetHashParam OpenProcessToken GetSidSubAuthority CryptAcquireContextW OpenThreadToken GetSidSubAuthorityCount GetTokenInformation RegCreateKeyExW CryptReleaseContext RegQueryValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW LookupPrivilegeValueW AllocateAndInitializeSid CryptCreateHash ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid RegOpenKeyExW GetSecurityDescriptorSacl CheckTokenMembership SetSecurityDescriptorSacl CryptDestroyHash AdjustTokenPrivileges RegCloseKey RegSetValueExW CryptHashData RegCreateKeyW RegEnumKeyW RegQueryInfoKeyW SetSecurityInfo ConvertSidToStringSidW InitiateSystemShutdownExW EqualSid RegDeleteValueW RegEnumValueW IsWellKnownSid GetLengthSid RegEnumKeyExW

shlwapi

PathMatchSpecW StrStrIW StrStrIA PathQuoteSpacesW PathRenameExtensionW StrCmpNIW PathIsURLW wvnsprintfA StrCmpNIA UrlUnescapeA PathRemoveBackslashW PathUnquoteSpacesW PathAddExtensionW PathCombineW SHDeleteKeyW PathSkipRootW SHDeleteValueW PathAddBackslashW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW wvnsprintfW

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket CoUninitialize CLSIDFromString StringFromGUID2 CoInitializeSecurity CoInitialize CoInitializeEx CoCreateInstance

gdi32

DeleteObject GetDIBits GetDeviceCaps CreateDIBSection RestoreDC SaveDC CreateCompatibleDC SetRectRgn SelectObject GdiFlush DeleteDC SetViewportOrgEx CreateCompatibleBitmap

ws2_32

send gethostbyname closesocket WSASend getaddrinfo listen WSASetLastError freeaddrinfo inet_addr getpeername recvfrom WSAIoctl connect WSAAddressToStringW WSAStartup WSAEventSelect getsockname accept bind recv sendto setsockopt shutdown WSAGetLastError select socket

crypt32

CryptUnprotectData PFXExportCertStoreEx CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertDeleteCertificateFromStore PFXImportCertStore

wininet

HttpSendRequestW HttpOpenRequestA HttpOpenRequestW InternetSetFilePointer HttpSendRequestA InternetSetStatusCallbackA HttpAddRequestHeadersA InternetGetCookieA InternetSetStatusCallbackW GetUrlCacheEntryInfoW InternetQueryOptionA InternetOpenA HttpAddRequestHeadersW InternetSetOptionA InternetCrackUrlA InternetQueryOptionW InternetConnectA InternetCloseHandle HttpEndRequestW InternetReadFile HttpSendRequestExA HttpQueryInfoA HttpSendRequestExW InternetQueryDataAvailable InternetReadFileExA HttpEndRequestA

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

netapi32

NetUserEnum NetApiBufferFree NetUserGetInfo

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

PlaySoundW waveOutSetVolume waveOutGetVolume PlaySoundA