94dd9d2404fc059abb54043932327c76[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

94dd9d2404fc059abb54043932327c76.bin
Size

203KB
MD5

bbbea99f65646e977c1ad269f9959818
SHA1

b42b1b01d55dcd63117d86ff2b60c443aa106a85
SHA256

89bccf7f8116719cd95e83fa3d847edacb8afee7922d9ad59bf49a42815546e8
SHA512

9f1a5b9edb6f81c06713c49791aaa60482f8b283425c416cd824317ff9f9ae34a95c9911b144acc0d47af948f3dc46c2f975a45ea3f585341b6299e14d450936
SSDEEP

6144:Kt+9Ftj8I6T8tw2ii16gN/WguDUe9gY+4H:QqFtj8Biii1xWguDUAgY+4H

Score

1^/10

Malware Config

Signatures

Files

94dd9d2404fc059abb54043932327c76.bin
.zip

Password: infected
2a1752d81c865b605efa5e0afbe440c2cf957029a2181bb9e02c0862bca0383b.exe
.exe windows x64

Password: infected

7bae02ef14998d8530ddf0278301170f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventWrite
RegCloseKey
EventRegister
EventUnregister
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegDeleteKeyW
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken

kernel32

GetProcessHeap
HeapAlloc
WaitForSingleObject
ReleaseMutex
CloseHandle
lstrlenW
GetModuleHandleExW
SetLastError
RegEnumValueW
RegGetValueW
CreateFileW
FileTimeToSystemTime
GetFileAttributesW
CompareFileTime
ResolveDelayLoadedAPI
DelayLoadFailureHook
MulDiv
SizeofResource
LockResource
LoadResource
FindResourceExW
GetSystemTime
FreeLibrary
SystemTimeToFileTime
GetTempFileNameW
CreateThread
UnregisterApplicationRecoveryCallback
ApplicationRecoveryFinished
timeGetTime
LoadLibraryW
GetLastError
LocalAlloc
LocalFree
OutputDebugStringW
CreateDirectoryW
GetCurrentThread
SetThreadPriority
ApplicationRecoveryInProgress
GetCommandLineW
DeleteFileW
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
RegisterApplicationRecoveryCallback
UnregisterApplicationRestart
RegisterApplicationRestart
GetProcAddress
GetVersionExW
OpenMutexW
DuplicateHandle
GetPrivateProfileStringW
CreateEventW
SetEvent
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
CompareStringW
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
MultiByteToWideChar
GetModuleFileNameW

gdi32

SetLayout
GdiAlphaBlend
CreateDIBSection
GetTextFaceW
CreateFontW
CreateRectRgn
GetObjectW
CreateSolidBrush
GetDeviceCaps
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetClipRgn
BitBlt
GetTextExtentPoint32W
DeleteDC
GdiGradientFill
DeleteObject

user32

CreateWindowExW
DestroyAcceleratorTable
GetUpdateRect
ShowWindow
GetScrollInfo
SetScrollInfo
SetScrollRange
ShowScrollBar
OffsetRect
CopyRect
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
ClientToScreen
DefWindowProcW
ReleaseDC
PtInRect
InflateRect
GetDesktopWindow
DestroyMenu
GetSubMenu
SetWindowPos
GetWindowRect
EndDeferWindowPos
BeginDeferWindowPos
PostMessageW
TrackPopupMenu
MapWindowPoints
ReleaseCapture
SystemParametersInfoW
LockWindowUpdate
UnregisterClassW
RegisterClassW
LoadIconW
IsClipboardFormatAvailable
SetGestureConfig
GetWindowLongPtrW
GetSystemMenu
EnableMenuItem
DestroyWindow
GetDC
SetCursor
SendMessageW
GetClientRect
GetAncestor
SetRect
GetCursorPos
ScreenToClient
GetScrollBarInfo
GetParent
SetWindowLongPtrW
GetWindowLongW
EnableWindow
FillRect
GetSysColorBrush
IsWindowVisible
GetKeyState
GetAsyncKeyState
SetScrollPos
GetWindowTextLengthW
GetWindowTextW
GetFocus
UpdateWindow
GetSysColor
EnableScrollBar
SetFocus
CreateCaret
SetCaretPos
SetTimer
KillTimer
ScrollWindowEx
SetCapture
MessageBoxW
ChangeWindowMessageFilter
RemoveMenu
GetWindowPlacement
SetWindowPlacement
PostQuitMessage
SetActiveWindow
IntersectRect
EqualRect
GetSystemMetrics
LoadAcceleratorsW
GetKeyboardLayout
LoadImageW
UnregisterClassA
BeginPaint
HideCaret
ShowCaret
EndPaint
GetMessageExtraInfo
TranslateAcceleratorW
InvalidateRect
UpdateLayeredWindow
DeferWindowPos
RegisterClassExW
SetProcessDPIAware
SetForegroundWindow
FindWindowW
LoadCursorW
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
LoadMenuW
MonitorFromWindow
GetMonitorInfoW
MonitorFromRect
CopyAcceleratorTableW

msvcrt

vswprintf_s
_vscwprintf
_wcsicmp
malloc
cos
sin
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
wcsncpy_s
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
__CxxFrameHandler3
??0exception@@QEAA@XZ
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
wcscpy_s
calloc
_purecall
free
_vsnwprintf
memmove
wcstoul
strchr
memcpy
memmove_s
memcpy_s
?what@exception@@UEBAPEBDXZ
__C_specific_handler
memset
_commode
wcscmp

ntdll

WinSqmIsOptedIn
WinSqmStartSession
WinSqmSetIfMaxDWORD
WinSqmAddToStream
WinSqmEndSession
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

shell32

SHGetFolderPathW
CommandLineToArgvW
SetCurrentProcessExplicitAppUserModelID
ShellExecuteW
SHCreateDirectoryExW
SHGetKnownFolderPath
ord165
SHGetSpecialFolderPathW

shlwapi

ord628
SHStrDupW
PathFileExistsW
ord184
ord212
ord16
ord219
ord154
SHCreateStreamOnFileW

ole32

PropVariantClear
CoCreateInstance
CoUninitialize
OleInitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
StgCreateStorageEx
StgOpenStorageEx
OleSaveToStream
WriteClassStm
OleLoadFromStream
CoSetProxyBlanket
OleUninitialize

oleaut32

SysAllocString
VarUI4FromStr
SystemTimeToVariantTime
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy

comctl32

ord345

uxtheme

OpenThemeData
CloseThemeData
GetThemeFont

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidCreateSequential

Sections

.text
Size: 261KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7bae02ef14998d8530ddf0278301170f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

shell32

shlwapi

ole32

oleaut32

comctl32

uxtheme

rpcrt4

Sections

.text Size: 261KB - Virtual size: 261KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 10KB - Virtual size: 10KB

.idata Size: 23KB - Virtual size: 23KB

.rsrc Size: 145KB - Virtual size: 144KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 261KB - Virtual size: 261KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 10KB - Virtual size: 10KB

.idata
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 145KB - Virtual size: 144KB

.reloc
Size: 1KB - Virtual size: 1KB