6499cadaea169c7dfe75b55f9c949659af49649a10c8b593a8db378692a11962[.]bin[.]sample (1)

Resubmissions

20/01/2023, 16:10

230120-tmdysaag61 1

19/01/2023, 17:49

230119-weamhadf81 1

10/01/2023, 19:35

230110-yaplzadb2z 1

Sharing

Copy URL Twitter E-mail

General

Target

6499cadaea169c7dfe75b55f9c949659af49649a10c8b593a8db378692a11962.bin.sample (1)
Size

237KB
MD5

a32f9c5e2c8dc89b2b27a6e7b6c5acdd
SHA1

3fb06e5679ebe320f3f392868ae3d9050fbb30c0
SHA256

6499cadaea169c7dfe75b55f9c949659af49649a10c8b593a8db378692a11962
SHA512

0509418c8abf62bc35619ff5c94b0b7919e6447b5fbe67d19234e8ec4da3945d6b1fdb996c4f60d37a808dca95767c66642b7a40439bb39a9359ffed40a2067f
SSDEEP

6144:5KErhCyWWy9nuqLheVzUYbG84D9Jrb+1FJ:QhYonrCzdC84GFJ

Score

N/A

Malware Config

Signatures

Files

6499cadaea169c7dfe75b55f9c949659af49649a10c8b593a8db378692a11962.bin.sample (1)
.exe windows x86

d4188567c97401d9985cb3af99aa9522

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetEnvironmentVariableW
GetTempPathW
lstrlenA
FindClose
CreateFileW
lstrcmpA
GetPrivateProfileSectionNamesW
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
GetLastError
GetFileAttributesExW
lstrcatW
DeleteFileW
HeapReAlloc
CloseHandle
GetNativeSystemInfo
GetSystemInfo
LoadLibraryW
CreateThread
HeapAlloc
GetLocalTime
GetProcAddress
LocalFree
GetFileSize
lstrcpynA
FindVolumeClose
GetProcessHeap
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
lstrcpyW
GetDynamicTimeZoneInformation
FindNextVolumeW
lstrcmpiW
lstrcmpW
WriteConsoleW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
GetConsoleMode
HeapSize
SetStdHandle
GetUserDefaultUILanguage
GetUserDefaultLocaleName
GetModuleFileNameW
GetPrivateProfileIntW
ExpandEnvironmentStringsW
lstrcpynW
WriteFile
lstrlenW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetFileType
FindNextFileW
HeapFree
FindFirstVolumeW
FindFirstFileW
GetVolumeInformationW
lstrcmpiA
ReadFile
DecodePointer
GetStringTypeW
GetACP
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
RaiseException
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

TranslateMessage
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
PostMessageW
DefWindowProcW
GetMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
CredFree
CredEnumerateW
CredReadW
RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
VariantInit
SysAllocString

winhttp

WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable

crypt32

CryptDecodeObjectEx
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData
CryptStringToBinaryW

shlwapi

StrRChrIW
PathStripToRootW
StrCmpNIW
PathCombineW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
StrStrIA
StrStrIW
PathFileExistsW
StrStrW
UrlGetPartW
PathFindExtensionW
StrToIntA
StrStrA
PathAppendW
StrStrNIW
StrRChrIA
PathAddExtensionW

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptGenerateSymmetricKey
BCryptDeriveKeyPBKDF2
BCryptEncrypt
BCryptDestroyKey
BCryptSetProperty
BCryptCreateHash
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptDeriveKeyCapi
BCryptDecrypt
BCryptGetProperty

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

d4188567c97401d9985cb3af99aa9522

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

winhttp

crypt32

shlwapi

bcrypt

Sections

.text Size: 190KB - Virtual size: 189KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 9KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 190KB - Virtual size: 189KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 9KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 6KB