00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271[.]bin

Resubmissions

22-09-2022 16:59

220922-vhwtgabhh6 10

20-09-2022 10:36

220920-mm8d3agdbq 3

Sharing

Copy URL

Twitter E-mail

General

Target

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.bin
Size

39KB
MD5

ec263f6b3a0ec7ede4960a2db469fb4e
SHA1

6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA256

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
SHA512

51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP

768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I

Score

N/A

Malware Config

Signatures

Files

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.bin
.exe windows x64

c94b93fac9b27e78a39713509240a40d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetQueryOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetCrackUrlA

iphlpapi

GetAdaptersAddresses
GetIpAddrTable

shlwapi

StrChrW
wnsprintfW

ws2_32

ntohl

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

GetTickCount
lstrcmpiW
SetThreadContext
CreateProcessA
CreateRemoteThread
FlushInstructionCache
GetStartupInfoA
EnterCriticalSection
GetCurrentProcess
lstrlenW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
lstrlenA
WaitForSingleObject
GetVersionExW
lstrcatA
GetModuleHandleA
OpenProcess
MultiByteToWideChar
SetEvent
lstrcatW
lstrcpyA
CloseHandle
GetSystemInfo
CreateThread
GetProcAddress
GetComputerNameW
WideCharToMultiByte
lstrcpyW
CreateEventA
QueryPerformanceCounter
GetVolumeInformationA
Sleep
ExitProcess
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
ReadFile
GetModuleFileNameA
WriteProcessMemory
SetHandleInformation
GetCommandLineW
WriteFile
VirtualAlloc
TerminateProcess
Wow64SetThreadContext
CreatePipe
Wow64GetThreadContext
PeekNamedPipe
GetEnvironmentVariableA
ResumeThread
CreateToolhelp32Snapshot
GetTempPathA
GetLastError
Process32NextW
CreateFileA
Process32FirstW
GetWindowsDirectoryA
GetThreadContext
VirtualAllocEx

user32

wsprintfA

advapi32

CreateProcessAsUserW
AdjustTokenPrivileges
AllocateAndInitializeSid
LookupPrivilegeValueA
LogonUserW
FreeSid
CheckTokenMembership
GetTokenInformation
DuplicateTokenEx
OpenProcessToken
LookupAccountSidW

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c94b93fac9b27e78a39713509240a40d

Headers

DLL Characteristics

File Characteristics

Imports

wininet

iphlpapi

shlwapi

ws2_32

userenv

kernel32

user32

advapi32

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 808B

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 808B

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B