163e651162f292028ca9a8d7f1ed7340[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

163e651162f292028ca9a8d7f1ed7340.bin
Size

334KB
MD5

ff32bdfe64b6ba3c3e21b76d978ba1f7
SHA1

31c9964a21b67b19592652dad42bd2f14571afc1
SHA256

7e62ba5d20453f60bdda8e67caa3eb91b4b6c3cca5203d206757b4b339eb24cb
SHA512

54c0dbb1425263ca891cffeb378a5f9ba8baba8f67ce0864f54e12ecc3bcb7c9a9ca54aae1ccb91ab73a71cfc5e04fe9a57ea4061e98af6324b58a5c1f7eff3b
SSDEEP

6144:qVpdyLkiFyRnGknCXS4ws3hPorz1Z4BwgIfa6aXEFahT08BzxshI/pVgMJbu9q9p:qVbyAHoXYsRgNZ4R5XwaFt3pVBoYr

Score

1^/10

Malware Config

Signatures

Files

163e651162f292028ca9a8d7f1ed7340.bin
.zip

Password: infected
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
.exe windows x86

Password: infected

b4d5733390854900e9a765684837c828

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader

mpr

WNetOpenEnumW
WNetCancelConnection2W
WNetAddConnection2W
WNetEnumResourceW
WNetCloseEnum

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

kernel32

SetStdHandle
GetStdHandle
GetCommandLineW
WriteFile
GetLastError
CreateMutexA
GetCurrentProcessId
GetCurrentThreadId
GetDynamicTimeZoneInformation
WideCharToMultiByte
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
CloseHandle
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFinalPathNameByHandleW
SetFileAttributesW
GetCurrentProcess
IsValidCodePage
GetProcAddress
LocalFree
GetDriveTypeW
GetCurrentThread
FormatMessageA
ExitThread
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateThread
LoadLibraryExW
FreeLibrary
GetTimeFormatW
GetACP
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
ReadFile
ReadConsoleW
GetConsoleOutputCP
ExitProcess
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
GetModuleFileNameW
GetCommandLineA
HeapAlloc
HeapFree
GetModuleHandleW
MultiByteToWideChar
QueryPerformanceCounter
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
TlsFree
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
GetDateFormatW

shell32

ShellExecuteW

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantInit
SysFreeString
SysAllocString

advapi32

LookupPrivilegeValueA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RevertToSelf
DuplicateTokenEx
SetThreadToken
SetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
EnumDependentServicesW
ControlService
CloseServiceHandle

Sections

.text
Size: 551KB - Virtual size: 550KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b4d5733390854900e9a765684837c828

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

mpr

wtsapi32

kernel32

shell32

ole32

oleaut32

advapi32

Sections

.text Size: 551KB - Virtual size: 550KB

.rdata Size: 121KB - Virtual size: 121KB

.data Size: 17KB - Virtual size: 22KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 551KB - Virtual size: 550KB

.rdata
Size: 121KB - Virtual size: 121KB

.data
Size: 17KB - Virtual size: 22KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 26KB - Virtual size: 26KB