9f421723706953ba239eaa685880b4c9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

9f421723706953ba239eaa685880b4c9.bin
Size

1.3MB
MD5

9f421723706953ba239eaa685880b4c9
SHA1

ca7ae9978bd05dafa5433b71a0fbb332071213ee
SHA256

aa696fd2f4e78f203e44fa282fb97aa31086c2b5c6040afa507c39ffd5847ef3
SHA512

b997739c2a1aa225976724ccfa5291d68f0301f6c17bd75d8fdb58753ec1261da7c9269c6cdcfd92bc71f428b05edd71339374ebaf969b7612a21195e3e71eba
SSDEEP

24576:KEW96cRSyG5GUGYt2KTt0jyb33EsiTQ+04oVTda2XpNyXgo4RMEVd:KEQtRS55G5Ycot0jyrWTMBXjRME/

Score

1^/10

Malware Config

Signatures

Files

9f421723706953ba239eaa685880b4c9.bin
.rar
26478_0001_________________________________________________________________________________________________________________________________________________________________.exe
.exe windows x86

4d8dc4afa00cc13a770f5ab5fc6fabc8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

VirtualQuery
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WideCharToMultiByte
GlobalMemoryStatusEx
MultiByteToWideChar
GetComputerNameExW
GetProcAddress
FreeLibrary
TlsGetValue
TlsSetValue
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
ReleaseSRWLockShared
PostQueuedCompletionStatus
GetHandleInformation
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
GetTickCount64
GetModuleHandleW
SetFileCompletionNotificationModes
SetHandleInformation
GetCurrentProcessId
SleepConditionVariableSRW
FormatMessageW
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
WaitForSingleObject
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateMutexW
lstrlenW
OpenProcess
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetExitCodeProcess
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
CreateFileW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetSystemInfo
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
DuplicateHandle
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
TerminateProcess
WaitForMultipleObjects
GetOverlappedResult
WakeAllConditionVariable
WakeConditionVariable
TlsAlloc
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
CopyFileExW
CreateEventW
ReadFile
CancelIo
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateThread
GetModuleHandleA
GetConsoleMode
WriteConsoleW
IsProcessorFeaturePresent
RaiseException
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId

advapi32

GetUserNameW
FreeSid
RegSetValueExW
AllocateAndInitializeSid
RegOpenKeyExW
RegCreateKeyExW
CheckTokenMembership
RegQueryValueExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegCloseKey
SystemFunction036

user32

GetDesktopWindow
EnumDisplayMonitors
MonitorFromPoint
GetWindowRect
GetMonitorInfoW
EnumDisplaySettingsExW

ws2_32

recv
WSASocketW
send
getsockopt
setsockopt
ioctlsocket
WSAStartup
WSAIoctl
WSASend
getaddrinfo
select
WSAGetLastError
connect
freeaddrinfo
WSACleanup
closesocket
WSARecv

gdi32

GetObjectW
SetStretchBltMode
DeleteObject
CreateDCW
GetDIBits
CreateCompatibleBitmap
StretchBlt
GetDeviceCaps
DeleteDC
SelectObject
CreateCompatibleDC

oleaut32

SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VariantClear
SafeArrayDestroy
SafeArrayGetLBound
SysAllocString
SysFreeString

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket

shell32

SHGetKnownFolderPath

ntdll

NtQuerySystemInformation

pdh

PdhRemoveCounter
PdhAddEnglishCounterW
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue
PdhOpenQueryA

powrprof

CallNtPowerInformation

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

iphlpapi

GetIfEntry2
GetIfTable2
FreeMibTable

bcrypt

BCryptGenRandom

psapi

EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

memcpy
__CxxFrameHandler3
memset
memcmp
_CxxThrowException
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
_except_handler4_common
__current_exception_context
__current_exception
memmove

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_set_app_type
_seh_filter_exe
__p___argv
exit
_exit
abort
_errno
terminate
_initterm
_wassert
_c_exit
_crt_atexit
_cexit
_register_onexit_function
_register_thread_local_exe_atexit_callback
__p___argc
_controlfp_s
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s
strcat_s

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d8dc4afa00cc13a770f5ab5fc6fabc8

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

user32

ws2_32

gdi32

oleaut32

ole32

shell32

ntdll

pdh

powrprof

netapi32

iphlpapi

bcrypt

psapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 771KB - Virtual size: 770KB

.data Size: 3KB - Virtual size: 4KB

.reloc Size: 92KB - Virtual size: 91KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 771KB - Virtual size: 770KB

.data
Size: 3KB - Virtual size: 4KB

.reloc
Size: 92KB - Virtual size: 91KB