5807531af298e0d14d428a6f13672eb7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

5807531af298e0d14d428a6f13672eb7.bin
Size

192KB
MD5

cce5a500a477369885748ca9225968ce
SHA1

b740da534d334a9577d0ba4412f787808c2af4ad
SHA256

3a6b38f95ff80fe1e2909c7e9f4ee143265b1b27ce8d10466a7ac7eae2a6dbb4
SHA512

bff9cf03211151901d281a1c5d5cce9db022e4a8ab42b6170a0b3cd2396815042e6a5b7e874007f5d901d14c6597084f9bc95affc041f131141b38aa49d9e514
SSDEEP

3072:KC0wMjhdvLn6WlSQM6lfijAY4D5x4RJwpz64K8tUMd/8VXWvPPZ5xDcmDx8:nHQbj6IxlKXY4jczFtUg+XwR5xDVDx8

Score

1^/10

Malware Config

Signatures

Files

5807531af298e0d14d428a6f13672eb7.bin
.zip

Password: infected
2f89870594c0f46353a3b8566674ae24617745a8ee954f42689da6b948c44099.exe
.exe windows x64

Password: infected

2a49d1af9482b46ff85239aac157270c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorLength
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegQueryValueExW
RegCloseKey
ConvertSidToStringSidW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegFlushKey
InitiateShutdownW
LookupAccountNameW
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorOwner
SetSecurityDescriptorControl
OpenSCManagerW
EnumServicesStatusW
CloseServiceHandle
OpenServiceW
QueryServiceConfigW
EventRegister
EventUnregister
EventWrite

kernel32

GetExitCodeProcess
IsWow64Process
GetCurrentProcess
GetNativeSystemInfo
ReleaseMutex
GetWindowsDirectoryW
GetFileAttributesW
GetUILanguageInfo
GetVersionExW
GetProductInfo
EnumUILanguagesW
DeviceIoControl
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
LocalAlloc
LocalFree
WaitForSingleObject
Sleep
CreateEventW
SetEvent
MultiByteToWideChar
CreateThread
GetFileMUIPath
GetSystemPowerStatus
GetSystemTime
SystemTimeToFileTime
CreateDirectoryW
GetFileSizeEx
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
GetSystemWindowsDirectoryW
GetModuleHandleW
GetFullPathNameW
FormatMessageW
lstrlenW
GetFileSize
ReadFile
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalFree
WideCharToMultiByte
SetFilePointer
SetEndOfFile
WriteFile
OutputDebugStringA
SearchPathW
GetEnvironmentVariableW
HeapSize
HeapDestroy
CreateProcessW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcAddress
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
SetUnhandledExceptionFilter
RaiseException
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
MoveFileExW
CompareFileTime
SetFileTime
DeleteFileW
CloseHandle
CreateMutexW
FreeLibrary
GetLastError
LoadLibraryW
SetLastError
GetFileAttributesExW

user32

MessageBoxW
UnregisterClassA

msvcrt

?terminate@@YAXXZ
__CxxFrameHandler3
iswspace
vsprintf_s
_vscprintf
_wtoi
iswdigit
wcstoul
_CxxThrowException
_vsnwprintf
_vsnprintf
wcsstr
_wtol
isdigit
_wcsnicmp
_purecall
wcschr
_wcslwr_s
towupper
wcscspn
_resetstkoflw
wcsrchr
vswprintf_s
_vscwprintf
??_V@YAXPEAX@Z
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
malloc
memset
__C_specific_handler
_wcsicmp
memmove_s
free
memcpy_s
??3@YAXPEAX@Z
_onexit
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
wcsncmp
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
calloc
memcpy

shell32

SHFileOperationW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoSetProxyBlanket
StringFromGUID2
CoGetMalloc
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantChangeType
VariantInit
VariantClear
SysAllocStringLen
SysFreeString

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNumberOfClearBits
RtlInitializeBitMap
RtlSetBits
RtlAreBitsSet
RtlAreBitsClear

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

shlwapi

PathFileExistsW
PathCombineW
SHCreateStreamOnFileW
PathIsURLW
PathRemoveFileSpecW
PathFindFileNameW

xmllite

CreateXmlReader

crypt32

CertFreeCertificateContext
CertAddCertificateContextToStore
CertCreateCertificateContext
CertCloseStore
CertOpenStore

userenv

UnloadUserProfile

sqmapi

SqmSetAppId
SqmSetEnabled
SqmGetSession
SqmIsWindowsOptedIn
SqmEndSession
SqmWaitForUploadComplete
SqmAddToStreamV
SqmSet
SqmReadSharedMachineId
SqmCreateNewId
SqmWriteSharedMachineId
SqmSetMachineId
SqmSetBits
SqmSetString
SqmStartUpload

winbrand

BrandingFormatString

wer

WerpSetCallBack
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerReportCreate

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

2a49d1af9482b46ff85239aac157270c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

oleaut32

version

ntdll

wtsapi32

shlwapi

xmllite

crypt32

userenv

sqmapi

winbrand

wer

wintrust

Sections

.text Size: 546KB - Virtual size: 546KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 546KB - Virtual size: 546KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB