79b00d62e0cdaac9f3231dc0de472e97[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

79b00d62e0cdaac9f3231dc0de472e97.bin
Size

146KB
MD5

aa74bc2af2dfafa80b15a61cd7d903af
SHA1

5e6ab59ef21878b9f58aa9c9b0b9b3c5ba1b4370
SHA256

09e722c9f4089f9a4a83316f4889004822d76be47156f0f594b2ace487477527
SHA512

602dc0a6f7d1a102309c9cfda71927da2d70f43483863f6f80bbd80ba19be8b195e6d88a5b916c695ff1301a006dcbc377d1ad5645cacfcbee69d5638d69aadc
SSDEEP

3072:9Jbm2+41GRUTGrjXSVsZ3niHnbFn2sh6MMjTNd5ZnUyc0EQl5KPhb/AEM:7bm2zT0xZen4Rd5dUJKEhblM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1efe7e276b7b35248dc5ff09a38e1f85b7c425367385fa51adaeebcca4e54e4c.exe

Files

79b00d62e0cdaac9f3231dc0de472e97.bin
.zip

Password: infected
1efe7e276b7b35248dc5ff09a38e1f85b7c425367385fa51adaeebcca4e54e4c.exe
.exe windows x86

Password: infected

dba326f5cd5a4dc03ea490628c7210fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SearchPathW
GetProfileIntW
BuildCommDCBAndTimeoutsA
InterlockedIncrement
InterlockedDecrement
SetMailslotInfo
GetSystemWindowsDirectoryW
GetProcessPriorityBoost
EnumCalendarInfoExW
WaitNamedPipeW
EnumTimeFormatsW
GetDriveTypeA
GetProcessTimes
GetVolumePathNameW
GetCalendarInfoA
GetConsoleAliasExesLengthW
GetFileAttributesA
WriteConsoleW
SetSystemPowerState
GetModuleFileNameW
CompareStringW
GetShortPathNameA
EnumSystemLocalesA
HeapCompact
DeleteFiber
GetLastError
GetProcAddress
AttachConsole
SetComputerNameA
EnterCriticalSection
GlobalFree
OpenWaitableTimerA
LoadLibraryA
GetProcessId
InterlockedExchangeAdd
LocalAlloc
AddAtomA
OpenJobObjectW
GetPrivateProfileStructA
FindFirstVolumeMountPointA
EnumDateFormatsA
CreateIoCompletionPort
GetModuleHandleA
CancelTimerQueueTimer
FreeEnvironmentStringsW
FindNextFileW
CreateMailslotA
SetCalendarInfoA
AreFileApisANSI
GlobalDeleteAtom
GetPrivateProfileIntW
GetVolumeNameForVolumeMountPointA
HeapFree
HeapAlloc
DeleteFileA
WideCharToMultiByte
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
IsProcessorFeaturePresent
HeapCreate
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
EncodePointer
LeaveCriticalSection
SetFilePointer
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameA
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
Sleep
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
CloseHandle
CreateFileW

gdi32

GetCharABCWidthsA
SelectObject

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 40.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

dba326f5cd5a4dc03ea490628c7210fa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

Sections

.text Size: 71KB - Virtual size: 70KB

.data Size: 86KB - Virtual size: 40.7MB

.rsrc Size: 108KB - Virtual size: 107KB

.text
Size: 71KB - Virtual size: 70KB

.data
Size: 86KB - Virtual size: 40.7MB

.rsrc
Size: 108KB - Virtual size: 107KB