296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin.exe
Size

4.4MB
MD5

8674100d43231294b6562717a9ab3a07
SHA1

f918e5f50bb3b73a732bc9cb3595bff2ea7b761f
SHA256

296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605
SHA512

21d09dfee3cb19432e8c5ceb6efa381538c0be4a9832e87a41be98d6c50fce895cbeada026f9b91e7d93b98ece77e8f5405f794706a4c0582791d5d770066a1d
SSDEEP

49152:cwRfTVhqLYdSO//XzoDB/1x0FKIrQyjzxTeIU6ihd:558LcroDt6bV+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin.exe

Files

296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin.exe
.exe windows x86

a8022619d5b6ddbb4e0a6338c92bd13c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

VirtualQuery
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WideCharToMultiByte
GlobalMemoryStatusEx
MultiByteToWideChar
GetComputerNameExW
GetProcAddress
FreeLibrary
CloseHandle
GetLastError
FormatMessageW
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
WaitForSingleObject
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateMutexW
lstrlenW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenProcess
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetTickCount64
GetExitCodeProcess
GetCurrentProcessId
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
CreateFileW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetSystemInfo
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
DuplicateHandle
GetStdHandle
SetHandleInformation
WriteFileEx
SleepEx
ReadFileEx
TerminateProcess
WaitForMultipleObjects
GetOverlappedResult
WakeAllConditionVariable
WakeConditionVariable
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexA
FindNextFileW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
CopyFileExW
CreateEventW
ReadFile
CancelIo
GetModuleHandleW
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateThread
GetModuleHandleA
GetConsoleMode
WriteConsoleW
IsProcessorFeaturePresent
RaiseException
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId

advapi32

GetUserNameW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegEnumKeyExW
RegCloseKey

user32

GetWindowRect
GetDesktopWindow
MonitorFromPoint
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsExW

gdi32

DeleteDC
GetDeviceCaps
GetDIBits
CreateDCW
GetObjectW
StretchBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
SetStretchBltMode
CreateCompatibleDC

oleaut32

SafeArrayUnaccessData
SafeArrayDestroy
SysFreeString
SysAllocStringLen
VariantClear
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayGetUBound
SysAllocString

ole32

CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitializeSecurity

shell32

SHGetKnownFolderPath

ws2_32

getsockopt
recv
WSAGetLastError
WSARecv
freeaddrinfo
WSACleanup
WSAStartup
WSASend
send
ioctlsocket
WSASocketW
connect
select
closesocket
getaddrinfo
setsockopt

ntdll

NtQuerySystemInformation

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhOpenQueryA
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhCloseQuery

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

bcrypt

BCryptGenRandom

psapi

EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
memset
__CxxFrameHandler3
memmove
memcmp
_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
memcpy

api-ms-win-crt-math-l1-1-0

floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s

api-ms-win-crt-runtime-l1-1-0

exit
_seh_filter_exe
_initterm
_set_app_type
_exit
__p___argc
__p___argv
_initterm_e
_configure_narrow_argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_controlfp_s
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 691KB - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8022619d5b6ddbb4e0a6338c92bd13c

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

user32

gdi32

oleaut32

ole32

shell32

ws2_32

ntdll

pdh

powrprof

netapi32

iphlpapi

bcrypt

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 691KB - Virtual size: 691KB

.data Size: 512B - Virtual size: 2KB

.reloc Size: 76KB - Virtual size: 76KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 691KB - Virtual size: 691KB

.data
Size: 512B - Virtual size: 2KB

.reloc
Size: 76KB - Virtual size: 76KB