One[.]bat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

One.bat
Size

666KB
MD5

2df197560f0176ed5d5b86a9dc64a4e3
SHA1

0f1c8a9e8e555fc8e1dac955b06fb0782d7230d7
SHA256

e934e59f5189215292007579abc2bf12adfec2a46df0bd672ea412b1668d35c6
SHA512

5131f20e587e109af60c3ecd03653585ab12cd04a402484340f3f40298a97282d06e049421b55045cd2a868c001c963ba0d8cc6c5508d73610d259e2efe2550c
SSDEEP

12288:JsEZturcxOSjNpxdYPiwlZmtjhv/0uC7ekS3Al1fsw3e:JsEZ2iOSjnAPiCY9/q

Score

1^/10

Malware Config

Signatures

Files

One.bat
.exe windows x86

1707f8a8231e3dcca12e47b548ed588a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
lstrlenA
WideCharToMultiByte
GetLastError
FindClose
FindFirstFileA
CloseHandle
UnmapViewOfFile
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
GetCurrentProcess
GetModuleHandleA
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
SetFilePointer
ReadFile
SystemTimeToFileTime
lstrcatA
GetFileInformationByHandle
GetDriveTypeA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MultiByteToWideChar
GetModuleFileNameA
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
LoadResource
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsValidCodePage
GetACP
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetConsoleMode
GetConsoleCP
HeapSize
CreateThread
LockResource
SizeofResource
ExitThread
HeapReAlloc
VirtualAlloc
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetVersionExA
lstrcmpW
SetLastError
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
LocalFree
FormatMessageA
lstrcmpA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WaitForSingleObject
GetCurrentProcessId
WritePrivateProfileStringA
GetModuleFileNameW
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetModuleHandleW
FileTimeToSystemTime
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
SetErrorMode
FileTimeToLocalFileTime
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
Sleep
ExitProcess

user32

GetSystemMetrics
GetWindowPlacement
GetMenu
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
CopyRect
AdjustWindowRectEx
GetSysColor
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
MessageBoxA
GetMenuItemCount
GetMenuItemID
GetSubMenu
IsWindowVisible
SetForegroundWindow
SetMenu
GetKeyState
MapWindowPoints
PeekMessageA
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
DispatchMessageA
GetLastActivePopup
GetForegroundWindow
GetWindowTextA
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetWindow
SetWindowsHookExA
GetCapture
WinHelpA
RegisterWindowMessageA
SetWindowTextA
ShowWindow
IsWindowEnabled
PostQuitMessage
ValidateRect
GetActiveWindow
TranslateMessage
GetMessageA
SetCursor
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetSysColorBrush
DestroyMenu
UnregisterClassA
GetWindowThreadProcessId
ClientToScreen
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadIconA
wsprintfA
PtInRect
PostMessageA
IsIconic
GetWindowRect
GetClientRect
GetDC
ReleaseDC
SystemParametersInfoA
SetWindowLongA
GetWindowLongA
SetWindowPos
GetCursorPos
GetParent
LoadCursorA
LoadBitmapA
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
SendMessageA
FindWindowA
FindWindowExA
EnableWindow
CallNextHookEx

gdi32

SetViewportExtEx
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetMapMode
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
GetDeviceCaps
GetStockObject
OffsetViewportOrgEx
ScaleViewportExtEx
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
CreateBitmap

shell32

ShellExecuteA

oleaut32

VariantClear
VariantChangeType
VariantInit

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA
PathFindFileNameA

wldap32

ord26
ord50
ord30
ord60
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord143
ord46
ord211
ord22
ord200

ws2_32

htonl
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
bind
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
ntohs
ntohl

crypt32

CertFreeCertificateContext

oleacc

CreateStdAccessibleObject
LresultFromObject

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegSetValueExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash

Sections

.text
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1707f8a8231e3dcca12e47b548ed588a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

oleaut32

comctl32

shlwapi

wldap32

ws2_32

crypt32

oleacc

winspool.drv

advapi32

Sections

.text Size: 411KB - Virtual size: 411KB

.rdata Size: 85KB - Virtual size: 84KB

.data Size: 9KB - Virtual size: 24KB

.rsrc Size: 106KB - Virtual size: 108KB

.reloc Size: 53KB - Virtual size: 53KB

.text
Size: 411KB - Virtual size: 411KB

.rdata
Size: 85KB - Virtual size: 84KB

.data
Size: 9KB - Virtual size: 24KB

.rsrc
Size: 106KB - Virtual size: 108KB

.reloc
Size: 53KB - Virtual size: 53KB