84037e5a56db32e636db640840cf8b28[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

84037e5a56db32e636db640840cf8b28.bin
Size

22KB
MD5

fda19e23527a537b5e532fafd59ef0ef
SHA1

2ba78acf6b8c0cac6433e44d1116e210ba0fe63f
SHA256

8e1e5aa646da912258451f64d2202ffb8967e56dc430b9d6256636e85c4a0de8
SHA512

883410ac9fa614802980b9f9fd850d23d815ead81a76c2738421e65597f3b997cf5209fd99d611ff271010bbdc5e33cb0332916b1c4cfc270dbfc1dd77ca80f1
SSDEEP

384:rWh+yiMQaPLq4G4tDoIqOgnpys60k9spjIia9WzxyVetjAd7unj3XuHg8y:rWtA2e549oIqOgnL6YIn9WtyG8dunj3N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.exe

Files

84037e5a56db32e636db640840cf8b28.bin
.zip

Password: infected
2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69.exe
.exe windows x86

Password: infected

b79142f1df6c12c1bc1cb268b4f995de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringEx
HeapSize
GetStringTypeW
WideCharToMultiByte
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
Sleep
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
EnumResourceTypesW
lstrlenW
VirtualAlloc
ExitProcess
ReadFile
LoadLibraryExW
CreateFileW
GetSystemTimeAsFileTime
GetCommandLineW
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
CloseHandle

rtm

RtmGetRouteAge
RtmDeregisterClient
MgmGetNextMfe

loadperf

LoadPerfCounterTextStringsA
UnloadPerfCounterTextStringsA

rtutils

TracePrintfA
TraceVprintfExW
TracePrintfW
RouterLogRegisterW
RouterLogEventStringW
TraceDumpExW

odbc32

ord11
ord262
ord107
ord41

mapi32

ord160
ord193
ord126
ord121
ord156
ord192
ord52

setupapi

SetupDiClassGuidsFromNameA
SetupDecompressOrCopyFileA
SetupFindFirstLineA
SetupDiGetClassDevsW

user32

GetMessageW
TranslateMessage
DispatchMessageW
SetWindowPos
UpdateWindow
BeginPaint
EndPaint
GetClientRect
MessageBoxW
LoadCursorW
CreateWindowExW
DefWindowProcW
PostQuitMessage
RegisterClassExW
ShowWindow

gdi32

SetTextColor
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateFontW
TextOutW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b79142f1df6c12c1bc1cb268b4f995de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

rtm

loadperf

rtutils

odbc32

mapi32

setupapi

user32

gdi32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB