4495780ea31862676766bce8ee4a0ffd[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

4495780ea31862676766bce8ee4a0ffd.bin
Size

148KB
MD5

567875a86acfbf79835b680c2d45229b
SHA1

35540c0978b46d1567b7f85499c2f2a46a2ef37c
SHA256

0723bdde7b089ee6ee641f190206a157371606c040270cf11c8de5123b71f557
SHA512

bb02d3cc6ac8b03f062dd1dc31cf145b807bdb99ecd30e3d991ba612bd836b0f086dca3262cd2215da06cd9b7b20c80688ae2dc95c96066b8987ea315a4686df
SSDEEP

3072:Kkcsx/VvUh/fM4TTxobntwHXpf+ACmtgpLDVEVNERrjMdd0pMy39VdONCP:pfFpUVM4HxobntkXpf+ACm5etf39V0N8

Score

1^/10

Malware Config

Signatures

Files

4495780ea31862676766bce8ee4a0ffd.bin
.zip

Password: infected
ea7923417b3cc0114c8c46cef7e2a797eb2ee978a0350a0d95a784ff151ca0f4.exe
.exe windows x86

Password: infected

338c60e12bfd108b93a60e97ac446d6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenJobObjectA
CreateJobObjectW
GetProcessPriorityBoost
GetModuleHandleW
FindNextVolumeMountPointA
EscapeCommFunction
GetWindowsDirectoryA
Sleep
GetConsoleAliasExesLengthW
DeleteVolumeMountPointW
GetStringTypeExW
GetFileAttributesA
GlobalFlags
GetBinaryTypeA
GetThreadPriorityBoost
GetConsoleAliasesW
GetLastError
GetProcAddress
VirtualAlloc
WriteProfileSectionA
EnterCriticalSection
LoadLibraryA
MoveFileExW
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
GetProfileStringA
QueryDosDeviceW
GetOEMCP
EnumDateFormatsA
GetModuleHandleA
FreeEnvironmentStringsW
GetStringTypeW
SetFileShortNameA
EndUpdateResourceA
GetVersionExA
FindAtomW
GetWindowsDirectoryW
CloseHandle
CreateFileA
CreateSemaphoreW
GetModuleHandleExA
GetStringTypeA
HeapFree
ExitProcess
GetStartupInfoW
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
HeapAlloc
HeapReAlloc
SetFilePointer
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
IsValidCodePage
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapSize
GetLocaleInfoA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW

user32

GetCaretBlinkTime
LoadIconA
CharLowerBuffW
CopyAcceleratorTableA
LoadMenuW
GetSysColorBrush
GetMenuInfo
SetCaretPos

advapi32

ReportEventW

winhttp

WinHttpSetOption

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 39.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pofe
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dohuw
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zavu
Size: 1024B - Virtual size: 723B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zotijid
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

338c60e12bfd108b93a60e97ac446d6a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

winhttp

Sections

.text Size: 72KB - Virtual size: 72KB

.data Size: 92KB - Virtual size: 39.4MB

.pofe Size: 1024B - Virtual size: 1024B

.dohuw Size: 6KB - Virtual size: 6KB

.zavu Size: 1024B - Virtual size: 723B

.zotijid Size: 1024B - Virtual size: 1024B

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 72KB - Virtual size: 72KB

.data
Size: 92KB - Virtual size: 39.4MB

.pofe
Size: 1024B - Virtual size: 1024B

.dohuw
Size: 6KB - Virtual size: 6KB

.zavu
Size: 1024B - Virtual size: 723B

.zotijid
Size: 1024B - Virtual size: 1024B

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 26KB - Virtual size: 26KB