Ping[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Ping.rar
Size

129KB
MD5

b52537b84d8ca975f1a5b264d05e0923
SHA1

1da8a058aa3c1b197bb126b1642ee32581932171
SHA256

75176c12fdbeddbd0b48c7e8539fb89f94b8723a1bfa059cf4f735a68c424f60
SHA512

0ce8e61496657460c1a6a249e5e777879c126b4aea9c8e234e7c1b5e95da8e2a2d25d4492d1745d07acf84d6ca4b5bd2043919a594534899f1148df5a8414f57
SSDEEP

3072:I76n0Bw0dVnADAiwmuXYKgpXzvpn62LJ3kDIGNGwd:s64VADAiGXng7n6gNGNGE

Score

1^/10

Malware Config

Signatures

Files

Ping.rar
.rar
Ping/Ping.exe
.exe windows x86

2c5f2513605e48f2d8ea5440a870cb9e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc

kernel32

GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
GetProcAddress
GetVersionExW
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize
CoTaskMemFree

shlwapi

PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW

Sections

.code
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ping/batbox.exe
.exe windows x86

2d8030efe657d301066381d1b8e5a7fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

printf
_getch
__getmainargs
exit
_kbhit
strtol
_open
_write
_read
_close
_chsize

kernel32

GetStdHandle
SetConsoleMode
SetConsoleTextAttribute
SetConsoleCursorPosition
ReadConsoleInputA
Sleep
SetConsoleCursorInfo
GetConsoleCursorInfo
GetConsoleWindow

user32

ShowWindow

Sections

.flat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ping/bg.exe
.exe windows x86

e406a81359c5214ba773f1f3d16bcc10

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

putchar
strtoul
memcpy
_kbhit
_getch
printf
strcmp
isxdigit
__getmainargs
exit

kernel32

GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleCursorPosition
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetLocalTime
Sleep
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleFont
WriteConsoleOutputA
GetConsoleWindow
GetConsoleOutputCP
SetConsoleOutputCP

winmm

PlaySoundA

user32

ShowWindow

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ping/spritebox.exe
.exe windows x86

bb165ad6107cff86f9231d66b580c34c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
SetConsoleOutputCP
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

_stricmp
_strnicmp
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_filbuf
_iob
_onexit
_setmode
abort
atexit
calloc
exit
fclose
fgets
fopen
fputs
free
fwrite
malloc
memcpy
perror
printf
putchar
puts
realloc
signal
strchr
strcpy
strstr
vfprintf

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 104B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c5f2513605e48f2d8ea5440a870cb9e

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

comctl32

shell32

winmm

ole32

shlwapi

Sections

.code Size: 14KB - Virtual size: 14KB

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 136KB - Virtual size: 136KB

2d8030efe657d301066381d1b8e5a7fb

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

Sections

.flat Size: 1KB - Virtual size: 1KB

e406a81359c5214ba773f1f3d16bcc10

Headers

File Characteristics

Imports

msvcrt

kernel32

winmm

user32

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

bb165ad6107cff86f9231d66b580c34c

Headers

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 16B

.rdata Size: 512B - Virtual size: 412B

.eh_fram Size: 1024B - Virtual size: 928B

.bss Size: - Virtual size: 104B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.code
Size: 14KB - Virtual size: 14KB

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 136KB - Virtual size: 136KB

.flat
Size: 1KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 412B

.eh_fram
Size: 1024B - Virtual size: 928B

.bss
Size: - Virtual size: 104B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B