a1eeeeae0eb365ff9a00717846c4806785d55ed20f3f5cbf71cf6710d7913c51[.]bin[.]sample

Sharing

Copy URL

Twitter E-mail

General

Target

a1eeeeae0eb365ff9a00717846c4806785d55ed20f3f5cbf71cf6710d7913c51.bin.sample
Size

2.7MB
MD5

b92a26068ba3653d8ec491f9702843e7
SHA1

eab1f025c6034d53466a8a9428d45008282591cc
SHA256

a1eeeeae0eb365ff9a00717846c4806785d55ed20f3f5cbf71cf6710d7913c51
SHA512

c71fac2a9e5bc1dc6cad5fa65331925cb52b885773824b59ef7d88238afcffc7b3d26abb8bd9d9369a87d0cba94b0f08f1b50494d6cfad71f18484232d487c26
SSDEEP

49152:xwXMnLR8e5wfFxYYLb8yBo5tPVB3RGePPjFFqcVYW/etxTWpKkZnR:xwXMn3+AUb8Go5LqIPzN2txap5nR

Score

N/A

Malware Config

Signatures

Files

a1eeeeae0eb365ff9a00717846c4806785d55ed20f3f5cbf71cf6710d7913c51.bin.sample
.exe windows x86

08a1caa94e76ba13885839591ccda893

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
FindFirstFileW
SetPriorityClass
FindNextFileW
TerminateProcess
RemoveDirectoryW
FindClose
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
Process32NextW
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
lstrcmpW
IsWow64Process
VirtualQueryEx
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
CancelIo
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
GetProcessHeap
HeapAlloc
HeapFree
AllocConsole
GetCurrentProcessId
SetCurrentDirectoryW
Wow64RevertWow64FsRedirection
Sleep
OpenProcess
Wow64DisableWow64FsRedirection
GetLocalTime
DeleteCriticalSection
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
PostQueuedCompletionStatus
LeaveCriticalSection
EnterCriticalSection
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateMutexW
WaitForMultipleObjects
GetFileTime
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
ReadFile
SystemTimeToFileTime
FindVolumeClose
SetVolumeMountPointW
GetDiskFreeSpaceExW
ExitThread
SetFileTime
DeviceIoControl
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ExitProcess
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
lstrlenW
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
CreateDirectoryW
lstrcmpiW
MultiByteToWideChar
CreateFileW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
GetQueuedCompletionStatus
DeleteTimerQueue
InitializeCriticalSection
AreFileApisANSI
GetFullPathNameW
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
CreateTimerQueueTimer
GetCommandLineW
GetFileSizeEx
GetModuleFileNameW
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
DeleteFileW
GetLastError
SetEndOfFile
WriteFile
SetEnvironmentVariableW

user32

GetProcessWindowStation
wsprintfW
wvsprintfW
GetUserObjectInformationW
MessageBoxW

advapi32

CryptGetUserKey
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
EnumServicesStatusW
OpenServiceW
RegDeleteValueW
ChangeServiceConfigW
EnumDependentServicesW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
EqualSid
CreateWellKnownSid
GetUserNameW
LookupAccountSidW
CloseServiceHandle
OpenSCManagerW
ControlService
GetTokenInformation

shell32

SHCreateItemFromParsingName
SHEmptyRecycleBinW
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoGetObject
CoInitializeEx
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathFileExistsW
StrStrIW
PathRemoveFileSpecW
StrStrIA
PathFindExtensionW
PathGetArgsW
PathRemoveExtensionW
PathStripPathW
StrStrW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

ws2_32

WSAGetLastError
socket
WSAStartup
WSASocketW
shutdown
gethostbyname
closesocket
bind
WSACleanup
recv
send
WSASetLastError
htons
inet_ntop
getsockopt
gethostname
inet_ntoa
WSAIoctl
WSAAddressToStringW
setsockopt

iphlpapi

GetIpNetTable
GetAdaptersInfo

netapi32

NetApiBufferFree
NetShareEnum

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

rstrtmgr

RmShutdown
RmRegisterResources
RmGetList
RmStartSession
RmEndSession

everything32

Everything_GetNumResults
Everything_DeleteRunHistory
Everything_SetSort
Everything_SetSearchW
Everything_GetResultFullPathNameW
Everything_QueryW
Everything_GetLastError
Everything_CleanUp
Everything_Exit
Everything_SetRequestFlags
Everything_GetResultSize
Everything_IsDBLoaded

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08a1caa94e76ba13885839591ccda893

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

ws2_32

iphlpapi

netapi32

mpr

rstrtmgr

everything32

bcrypt

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 451KB - Virtual size: 451KB

.data Size: 14KB - Virtual size: 32KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 64KB - Virtual size: 63KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 451KB - Virtual size: 451KB

.data
Size: 14KB - Virtual size: 32KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 64KB - Virtual size: 63KB