f8412ea00c09808959281109e0363c84[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

f8412ea00c09808959281109e0363c84.bin
Size

132KB
MD5

9ed89c97bf01273ffbf66a9eb6bf7cbb
SHA1

083e5779a7bb65fc5455e12b28cafbabaf8d06ad
SHA256

4123c20514685ef476a011f30c73c38c24b6a5631e19290ce7a4cdaccb1a43ef
SHA512

26702b2ce17d7eaa85a5b0f2c515e755654e0f56ccb8bbf94935a17eb2d78757fa2d92bdc8261a7339c9962295c45bba6b800008a4f5f2896cd59afe441da1da
SSDEEP

3072:C/aPDskF7dlUEoraLYwYn/Hnjh+kEdqrQM7dMHh39zqogacN0Ht:C/WdlzYv/HN+k80SHLzngacgt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/33f93086c8ad0c614e01c503d5c299b5fc86c480007597756de02884bccc5e67.exe

Files

f8412ea00c09808959281109e0363c84.bin
.zip

Password: infected
33f93086c8ad0c614e01c503d5c299b5fc86c480007597756de02884bccc5e67.exe
.exe windows x64

Password: infected

8a8dc8ce5095001627500b8a055afd28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateTokenEx
AdjustTokenPrivileges
EventRegister
EventUnregister
RevertToSelf
GetTokenInformation
CreateWellKnownSid
IsValidSid
SetTokenInformation
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
StartServiceW
ControlService
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession

kernel32

CallbackMayRunLong
OpenProcess
TrySubmitThreadpoolCallback
IsWow64Process
GetPriorityClass
GetTimeFormatW
GetExitCodeThread
GetTempPathW
CreateFileW
DuplicateHandle
GetModuleFileNameW
LocalFree
GetLogicalProcessorInformationEx
GetNumaHighestNodeNumber
SetEvent
CreateToolhelp32Snapshot
Thread32First
OpenThread
Thread32Next
Sleep
lstrcmpW
GetComputerNameW
GetCommandLineW
LoadLibraryExA
DelayLoadFailureHook
ReadProcessMemory
lstrcmpiW
CompareStringW
lstrlenW
GetLocaleInfoW
GetNumberFormatW
GetTickCount
HeapSize
MulDiv
HeapReAlloc
FormatMessageW
CloseThreadpoolCleanupGroup
SetProcessShutdownParameters
CreateEventW
CreateThreadpoolCleanupGroup
GetErrorMode
SetErrorMode
GetCurrentProcessId
ProcessIdToSessionId
SetPriorityClass
DeviceIoControl
SetLastError
LockResource
LoadResource
FindResourceExW
HeapSetInformation
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
WaitForSingleObject
CreateProcessW
ExpandEnvironmentStringsW
CreateThread
CloseHandle
ReleaseMutex
CloseThreadpoolCleanupGroupMembers
GetCurrentDirectoryW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
QueryFullProcessImageNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW

gdi32

SetBkMode
GetCurrentObject
GetObjectW
CreateFontIndirectW
GetCharWidth32W
CreateCompatibleBitmap
SetBkColor
DeleteDC
CreateCompatibleDC
SetTextColor
GetDeviceCaps
Rectangle
BitBlt
LineTo
MoveToEx
SelectObject
DeleteObject
GetStockObject
CreatePen

user32

SendMessageTimeoutW
SetProcessDPIAware
RegisterWindowMessageW
MessageBoxW
CreateDialogParamW
ChangeWindowMessageFilterEx
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadMenuW
RemoveMenu
DestroyMenu
CreateWindowExW
DrawTextW
InvalidateRect
UpdateWindow
GetWindowLongPtrW
GetSysColor
GetDlgCtrlID
EnableMenuItem
AppendMenuW
DialogBoxParamW
SetScrollInfo
GetScrollInfo
SetScrollPos
EndDialog
GetSystemMetrics
GetGuiResources
EnableWindow
TrackPopupMenuEx
GetWindowTextW
SetDlgItemTextW
IsHungAppWindow
SetThreadDesktop
IsWindowVisible
EndTask
AllowSetForegroundWindow
EnumDesktopsW
GetProcessWindowStation
OpenDesktopW
EnumDesktopWindows
CloseDesktop
GetWindow
InternalGetWindowText
ShowWindowAsync
SetMenuDefaultItem
GetLastActivePopup
IsWindow
SwitchToThisWindow
TileWindows
GetDesktopWindow
CascadeWindows
PeekMessageW
GetCursorPos
CheckDlgButton
IsDlgButtonChecked
GetWindowTextLengthW
SetCursor
LoadCursorW
SetRect
MsgWaitForMultipleObjects
FindWindowW
SetFocus
GetNextDlgTabItem
GetClassNameW
GetFocus
GetParent
GetMonitorInfoW
MonitorFromPoint
LoadAcceleratorsW
PostQuitMessage
MessageBeep
RedrawWindow
MoveWindow
GetClassLongPtrW
GetWindowThreadProcessId
DefWindowProcW
GetMenuItemID
GetSubMenu
IsZoomed
IsIconic
SetForegroundWindow
OpenIcon
KillTimer
DestroyWindow
PostMessageW
LoadImageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ShowWindow
GetShellWindow
SetWindowLongPtrW
GetMenuItemInfoW
SetTimer
LoadIconW
GetThreadDesktop
GetDialogBaseUnits
GetWindowRect
PostThreadMessageW
GetForegroundWindow
SendMessageW
MapWindowPoints
GetDlgItem
SetMenu
SetWindowPos
DeleteMenu
CheckMenuItem
CheckMenuRadioItem
GetMenu
SetWindowTextW
LoadStringW
RegisterClassW
GetClassInfoW
ReleaseDC
GetDC
SystemParametersInfoW
GetKeyState
CallWindowProcW
GetSysColorBrush
FillRect
GetClientRect
GhostWindowFromHungWindow
HungWindowFromGhostWindow
SetWindowLongW
GetWindowLongW
DestroyIcon

msvcrt

?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wtol
??3@YAXPEAX@Z
swscanf_s
memmove
_ui64tow_s
wcsstr
_i64tow_s
_wcsicmp
wcsrchr
_vsnwprintf
_wcsdup
??2@YAPEAX_K@Z
memset
_exit
memcpy
free
towlower

iphlpapi

GetIfEntry2
NhGetInterfaceNameFromDeviceGuid
GetAdaptersAddresses

pcwum

PcwCollectData
PcwAddQueryItem
PcwCreateQuery

shlwapi

StrFormatByteSizeW
ord16
PathAddExtensionW
PathRemoveExtensionW
PathAppendW
StrStrW
ord348
ord618
ord437
ord158

shell32

ord61
ShellAboutW
ShellExecuteExW
ord245
ord75
SHParseDisplayName
SHOpenFolderAndSelectItems
CommandLineToArgvW
ord100
DuplicateIcon
Shell_NotifyIconW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlTryEnterCriticalSection
NtSetInformationFile
NtSetInformationProcess
NtOpenProcessToken
NtOpenThreadToken
NtOpenFile
RtlTimeToElapsedTimeFields
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtQueryInformationProcess
NtQueryTimerResolution
RtlInitUnicodeString
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
WinSqmAddToStream
NtQueryInformationToken
NtClose

secur32

GetUserNameExW

uxtheme

IsThemeActive
SetWindowTheme

wevtapi

EvtSubscribe
EvtClose

credui

CredUIPromptForCredentialsW

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8a8dc8ce5095001627500b8a055afd28

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

iphlpapi

pcwum

shlwapi

shell32

ntdll

secur32

uxtheme

wevtapi

credui

Sections

.text Size: 152KB - Virtual size: 152KB

.data Size: 2KB - Virtual size: 15KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 87KB - Virtual size: 88KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 152KB

.data
Size: 2KB - Virtual size: 15KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 87KB - Virtual size: 88KB

.reloc
Size: 1KB - Virtual size: 1KB