6b5c6ba95c1a528f205ade408d389375[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6b5c6ba95c1a528f205ade408d389375.bin
Size

1.9MB
MD5

0604efb5cba7f67352d241c1acade34a
SHA1

4043445f92c97a4436a329f97bf7f38255a1eed6
SHA256

0cce5c2add988f05135d3cbe35834b87f5ebc311d806b9f56f2bec8716a15e79
SHA512

49b09bae479eb5740c85a9bbec083e64b0b9e3597f2b2f987b36e3c095e6c6ba0112f4e982735a16f01d31e6a562e28de0fef9c53b8983b458eb3420f77382ff
SSDEEP

49152:5soz9igr69hgQs2v8WkdpPKIUUgLVeIWS6BXjqqj11JaS:56q696N2SiIjKAIu9jT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/98abcc6f294bd8549a963bbeccb0e01013dd42cc61a07aa496793aa667630a2b.exe

Files

6b5c6ba95c1a528f205ade408d389375.bin
.zip

Password: infected
98abcc6f294bd8549a963bbeccb0e01013dd42cc61a07aa496793aa667630a2b.exe
.exe windows x86

Password: infected

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ