66f25753bd10492a458f3ab1b6bd71da[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

66f25753bd10492a458f3ab1b6bd71da.bin
Size

192KB
MD5

8d5d3c3b19037a47f31ab7aab3b82442
SHA1

68f1535cb11d35852de1da051889cacd8e4c20d9
SHA256

b79887102b9b9873fea3485db32007eb3a6253a4b2e1f67e8d3cb50f36a9f72c
SHA512

7f77b2e34301aec0671ba13c04761260b4534849fe56a7379f95447345c5810da69e7d337edbb40f1b4fdceb0e78c75b8c521a79ef50942bab8cff9b900e23ea
SSDEEP

6144:YkU3S7NCuo08z6jmlgNKvTS1yB+HP1qwJ:Yk7jolzlFvT0yB+gwJ

Score

1^/10

Malware Config

Signatures

Files

66f25753bd10492a458f3ab1b6bd71da.bin
.zip

Password: infected
94b3090468a91d8b931539c75565b8dc879bea77a1e1c106ae822d0526e6e636.exe
.exe windows x64

Password: infected

2a49d1af9482b46ff85239aac157270c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorLength
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegQueryValueExW
RegCloseKey
ConvertSidToStringSidW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegFlushKey
InitiateShutdownW
LookupAccountNameW
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorOwner
SetSecurityDescriptorControl
OpenSCManagerW
EnumServicesStatusW
CloseServiceHandle
OpenServiceW
QueryServiceConfigW
EventRegister
EventUnregister
EventWrite

kernel32

GetExitCodeProcess
IsWow64Process
GetCurrentProcess
GetNativeSystemInfo
ReleaseMutex
GetWindowsDirectoryW
GetFileAttributesW
GetUILanguageInfo
GetVersionExW
GetProductInfo
EnumUILanguagesW
DeviceIoControl
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
LocalAlloc
LocalFree
WaitForSingleObject
Sleep
CreateEventW
SetEvent
MultiByteToWideChar
CreateThread
GetFileMUIPath
GetSystemPowerStatus
GetSystemTime
SystemTimeToFileTime
CreateDirectoryW
GetFileSizeEx
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
GetSystemWindowsDirectoryW
GetModuleHandleW
GetFullPathNameW
FormatMessageW
lstrlenW
GetFileSize
ReadFile
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalFree
WideCharToMultiByte
SetFilePointer
SetEndOfFile
WriteFile
OutputDebugStringA
SearchPathW
GetEnvironmentVariableW
HeapSize
HeapDestroy
CreateProcessW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcAddress
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
SetUnhandledExceptionFilter
RaiseException
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
MoveFileExW
CompareFileTime
SetFileTime
DeleteFileW
CloseHandle
CreateMutexW
FreeLibrary
GetLastError
LoadLibraryW
SetLastError
GetFileAttributesExW

user32

MessageBoxW
UnregisterClassA

msvcrt

?terminate@@YAXXZ
__CxxFrameHandler3
iswspace
vsprintf_s
_vscprintf
_wtoi
iswdigit
wcstoul
_CxxThrowException
_vsnwprintf
_vsnprintf
wcsstr
_wtol
isdigit
_wcsnicmp
_purecall
wcschr
_wcslwr_s
towupper
wcscspn
_resetstkoflw
wcsrchr
vswprintf_s
_vscwprintf
??_V@YAXPEAX@Z
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
malloc
memset
__C_specific_handler
_wcsicmp
memmove_s
free
memcpy_s
??3@YAXPEAX@Z
_onexit
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
wcsncmp
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
calloc
memcpy

shell32

SHFileOperationW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoSetProxyBlanket
StringFromGUID2
CoGetMalloc
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantChangeType
VariantInit
VariantClear
SysAllocStringLen
SysFreeString

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNumberOfClearBits
RtlInitializeBitMap
RtlSetBits
RtlAreBitsSet
RtlAreBitsClear

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

shlwapi

PathFileExistsW
PathCombineW
SHCreateStreamOnFileW
PathIsURLW
PathRemoveFileSpecW
PathFindFileNameW

xmllite

CreateXmlReader

crypt32

CertFreeCertificateContext
CertAddCertificateContextToStore
CertCreateCertificateContext
CertCloseStore
CertOpenStore

userenv

UnloadUserProfile

sqmapi

SqmSetAppId
SqmSetEnabled
SqmGetSession
SqmIsWindowsOptedIn
SqmEndSession
SqmWaitForUploadComplete
SqmAddToStreamV
SqmSet
SqmReadSharedMachineId
SqmCreateNewId
SqmWriteSharedMachineId
SqmSetMachineId
SqmSetBits
SqmSetString
SqmStartUpload

winbrand

BrandingFormatString

wer

WerpSetCallBack
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerReportCreate

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

2a49d1af9482b46ff85239aac157270c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

oleaut32

version

ntdll

wtsapi32

shlwapi

xmllite

crypt32

userenv

sqmapi

winbrand

wer

wintrust

Sections

.text Size: 546KB - Virtual size: 546KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 546KB - Virtual size: 546KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB