8b5e163c4645fd9ea96e241706f2b5d7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

8b5e163c4645fd9ea96e241706f2b5d7.bin
Size

212KB
MD5

d6eab53476bf55df90abac51cd113416
SHA1

d13a213fb9417fc059f629b89e3e4f2feffeeb69
SHA256

62fca9c6725403affb3f7f0e6653fbf62382f3d16a73c1af68b51cf419672bf1
SHA512

9c6ef28913dbcff9d236af2a7d6fd9c8439a2d9fd7f583e05559e880c96f7e46ee35855e07128a98a2c1c0156c28ca4f6b649622d0f4760dbc3fdb53297b4264
SSDEEP

6144:jIn0yh3jSHq/ZPOxiAG5lQ44bjfBgJTBF4VF5h5:jInBhTSKxPOxixk40j5gJTBFo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3d59c1b58d638d953978177f75eef3a731e5a315ae390ef1ad6f4f2864ccb9cf.exe

Files

8b5e163c4645fd9ea96e241706f2b5d7.bin
.zip

Password: infected
3d59c1b58d638d953978177f75eef3a731e5a315ae390ef1ad6f4f2864ccb9cf.exe
.exe windows x86

Password: infected

5affbd003e86f6425e6f5983fd37fec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

_lwrite
GetLogicalDriveStringsW
WaitForSingleObject
AddConsoleAliasW
GetModuleHandleW
GetTickCount
VirtualFree
GetConsoleAliasesA
GetNumberFormatA
ReadConsoleW
GetConsoleAliasExesW
FindResourceExA
GlobalAlloc
GetCalendarInfoW
FormatMessageW
GetSystemTimeAdjustment
GlobalFlags
FindNextVolumeW
ReadFile
CreateActCtxA
GetACP
GetLargestConsoleWindowSize
InterlockedExchange
SetCurrentDirectoryA
GetLocaleInfoA
GetLastError
GetCurrentDirectoryW
GetProcAddress
VirtualAlloc
IsValidCodePage
LoadLibraryA
WriteConsoleA
FindFirstVolumeMountPointW
SetConsoleCtrlHandler
FindAtomA
GetModuleFileNameA
GetCommTimeouts
OpenFileMappingW
CreateMutexA
VirtualProtect
GetCurrentThreadId
GetVersionExA
FileTimeToLocalFileTime
GetCurrentProcessId
ReadConsoleOutputCharacterW
CommConfigDialogW
WriteConsoleW
CreateTimerQueue
SetDefaultCommConfigA
GetDateFormatW
OpenMutexW
LocalUnlock
GetConsoleOutputCP
GetProcessHeap
SetEndOfFile
SetStdHandle
FlushFileBuffers
HeapFree
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
HeapCreate
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
WriteFile
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
CloseHandle
CreateFileA
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetCaretPos
LoadMenuW
CharUpperBuffW

gdi32

GetCharacterPlacementW

advapi32

MapGenericMask
ReportEventW

ole32

ReadClassStg

winhttp

WinHttpOpen

msimg32

AlphaBlend

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

5affbd003e86f6425e6f5983fd37fec5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

winhttp

msimg32

Sections

.text Size: 218KB - Virtual size: 217KB

.data Size: 6KB - Virtual size: 2.7MB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 218KB - Virtual size: 217KB

.data
Size: 6KB - Virtual size: 2.7MB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 11KB - Virtual size: 11KB