CI0658357[.]exe[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

CI0658357.exe.bin
Size

1.0MB
MD5

a3e733c8291fba59f3b2183dca008507
SHA1

791acb2e7bc3712f76462480258186a6f33e8c04
SHA256

1c9d339f96c25b3b8d06131a49e09169d42d663a3499eb870f8dee021497b8b5
SHA512

144ce115ca3a425d443e2076d25c49f10a35d4cd09e92441b0b75299dcdf009dbea5a6fe708b485650f5c681c21eba3a90011208910cbcc472eb49308f1e3b51
SSDEEP

12288:3++gtQtCm4yiiguuR3uq+CjCk8feoFgAXuRs26B6T8H3+H+5CAvG:OIT4i0CkO5HJB6gX+H+57+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CI0658357.exe.bin

Files

CI0658357.exe.bin
.exe windows x86

2f997d96f9e0d12fdac20c1f50c8b860

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetVersionExW
InterlockedExchange
FreeLibraryAndExitThread
GetFileAttributesW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
GetCurrentProcess
GetModuleFileNameW
LocalFree
LocalReAlloc
LocalAlloc
GetProfileStringW
lstrlenW
CompareStringW
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRecoveryCallback
RegisterApplicationRestart
CompareFileTime
SystemTimeToFileTime
GetTempFileNameW
FileTimeToSystemTime
DeleteFileW
CreateFileW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
VirtualProtect
VirtualAlloc
FreeConsole
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteConsoleW
HeapQueryInformation
SetConsoleCtrlHandler
GetStringTypeW
HeapFree
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
GetTimeFormatW
OutputDebugStringW
GetSystemInfo
HeapValidate
GetACP
GetCommandLineW
GetCommandLineA
GetModuleFileNameA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
FreeLibrary
LoadLibraryW
GetProcAddress
GetLocaleInfoEx
lstrcmpiW
GetPrivateProfileStringW
WritePrivateProfileStringW
InterlockedIncrement
GetDateFormatW
GetLocaleInfoW
GetLocalTime
MultiByteToWideChar
InterlockedDecrement
GetLastError
GlobalFindAtomW
MulDiv
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
lstrcmpW
ResetEvent
CreateEventW
HeapAlloc
CreateThread
WaitForSingleObject
DecodePointer
CloseHandle
SetEvent
GetSystemTime
GetModuleHandleW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoA
WideCharToMultiByte
SetStdHandle
lstrlenA

user32

ShowWindow
GetClientRect
GetParent
SetWindowTextW
LoadStringW
EnableWindow
GetWindowTextW
GetWindowTextLengthW
LoadAcceleratorsW
IsDialogMessageW
GetKeyState
SetCursor
GetWindowPlacement
SendMessageW
SetWindowPos
GetWindowRect
GetDlgItem
GetClassNameW
MapWindowPoints
DestroyWindow
EnableMenuItem
EndDialog
FindWindowW
GetAncestor
CreatePopupMenu
TrackPopupMenu
LoadImageW
UnregisterClassA
FillRect
LoadCursorW
CheckMenuRadioItem
CreateWindowExW
GetSysColor
SetClassLongW
GetClassLongW
CreateDialogParamW
GetProcessDefaultLayout
EnumDesktopWindows
GetClassWord
MonitorFromRect
EqualRect
EnumDisplayMonitors
IntersectRect
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
RemoveMenu
GetSubMenu
GetWindowLongW
InsertMenuItemW
SetWindowLongW
IsWindowEnabled
PostMessageW
CharNextA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
GetMenuState
IsClipboardFormatAvailable
DefWindowProcW
InvalidateRect
EnumChildWindows
PostQuitMessage
GetFocus
DispatchMessageW
TranslateMessage
GetMessageExtraInfo
MessageBeep
SystemParametersInfoW
DialogBoxParamW
MessageBoxA
SetFocus
TranslateAcceleratorW
GetMessageW
SetForegroundWindow
SetWindowPlacement
RegisterClassExW
DrawTextW
ReleaseDC
GetDC
CopyRect
MonitorFromWindow
GetMonitorInfoW
OffsetRect
GetNextDlgTabItem
CheckMenuItem
SetDlgItemInt
GetDlgItemInt
MoveWindow
IsDlgButtonChecked
SendDlgItemMessageW
UpdateWindow
CheckRadioButton
GetMenu
SetPropW
GetSystemMetrics

gdi32

SetBkColor
GetStockObject
SetBkMode
SetTextColor
CreatePatternBrush
SelectObject
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleBitmap
ExtCreatePen
MoveToEx
LineTo
GetObjectW
GetTextExtentPoint32W
GetTextMetricsW
CreateSolidBrush
EqualRgn
CreateDIBSection
DeleteObject
DeleteDC
GetTextExtentPointW
CreateFontIndirectW
CreateCompatibleDC
GetRgnBox
GetDeviceCaps

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
OpenSCManagerW
OpenServiceW
EventRegister
EventUnregister
EventWrite
RegCloseKey
RegCreateKeyExW
CloseServiceHandle
QueryServiceConfigW
RegOpenKeyExW

shell32

ShellAboutW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

comctl32

ImageList_Create
ImageList_Destroy
PropertySheetW
ImageList_LoadImageW
ImageList_SetBkColor
CreatePropertySheetPageW
ImageList_Add

gdiplus

GdipDrawLineI
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdiplusStartup
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipSetPageUnit
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipCloneBrush
GdipFillRectangleI
GdipDrawArcI
GdiplusShutdown

rpcrt4

UuidToStringW
UuidCreate
I_UuidCreate
RpcStringFreeW

uxtheme

IsThemeActive

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

winmm

timeGetTime

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f997d96f9e0d12fdac20c1f50c8b860

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

gdiplus

rpcrt4

uxtheme

version

winmm

Sections

.text Size: 460KB - Virtual size: 460KB

.rdata Size: 552KB - Virtual size: 552KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 460KB - Virtual size: 460KB

.rdata
Size: 552KB - Virtual size: 552KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 18KB