2340e5a6a0387c7667b80b09223fc33e[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

2340e5a6a0387c7667b80b09223fc33e.bin
Size

367KB
MD5

6e5104299f6cb847710c8aeefacf741c
SHA1

966611749b31a098f74b2f7312894d2f8213a1b5
SHA256

8f8cc4a618db0635c6a95a53ca8b3ce30c04d8e91aaaba7f9f89974b2856a340
SHA512

38491cdc1605830026d64968774e48b5f2bc344ef432398be43399d33896c715b9aff5d92005e9d878b2fcd63901557af80f2aee7911d7e2337d68d46dc8ca96
SSDEEP

6144:2E3UecLpIRmHk3WgZW6+c5tlZmMkbEWhuibkqdHX8ZSohyQf31rnfcMgIeWD/8Re:fEH+HGcxX5tlZm8WhNka38ZSohy6gIe+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/15f8834094557f509c52b65b3cf8bd1dbe8d2760c50101ea63226c397d71b389.exe

Files

2340e5a6a0387c7667b80b09223fc33e.bin
.zip

Password: infected
15f8834094557f509c52b65b3cf8bd1dbe8d2760c50101ea63226c397d71b389.exe
.exe windows x86

Password: infected

8bd33656afc728ed43242aa9d72344ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileInformationByHandle
GetDriveTypeA
MulDiv
GlobalAlloc
SetLastError
GlobalLock
GlobalUnlock
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
lstrlenA
lstrcatA
SystemTimeToFileTime
ReadFile
SetFilePointer
GetCurrentThreadId
CreateFileA
UnmapViewOfFile
FindFirstFileA
FindClose
GetLastError
ExitProcess
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
LoadLibraryA
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
CloseHandle
GetModuleHandleA
GetProcAddress
GetCurrentProcess
DeleteFileA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
MultiByteToWideChar
LocalFree
FormatMessageA
GlobalFree
GetFileTime
GetFullPathNameA
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationA
GetModuleFileNameA
GetVersionExA
lstrcmpW
CompareStringA
FreeLibrary
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
GetModuleFileNameW
InterlockedDecrement
GetCurrentProcessId
lstrcmpA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WaitForSingleObject
GetTickCount
WritePrivateProfileStringA
GetModuleHandleW
InterlockedIncrement
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSizeEx
GlobalFlags
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
Sleep
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
WinExec
GetWindowsDirectoryA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
SizeofResource

user32

MapWindowPoints
PeekMessageA
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
DispatchMessageA
SetActiveWindow
GetLastActivePopup
GetForegroundWindow
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
DestroyMenu
GetActiveWindow
RedrawWindow
GetDesktopWindow
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
SetForegroundWindow
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
MapDialogRect
SetWindowContextHelpId
WindowFromPoint
IsRectEmpty
GetSysColorBrush
UnregisterClassA
CopyAcceleratorTableA
PostThreadMessageA
CharNextA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatA
CopyIcon
PostMessageA
MessageBoxA
CreateWindowExA
GetSubMenu
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
PtInRect
DefWindowProcA
GetMenu
IntersectRect
GetWindowPlacement
IsChild
GetMenuItemCount
AdjustWindowRectEx
CharUpperA
GetWindowTextLengthA
SetWindowPos
SetFocus
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
ClientToScreen
IsIconic
GetParent
EnableWindow
SetMenu
GetKeyState
SetCapture
ReleaseCapture
GetCursorPos
LoadCursorA
SetCursor
IsWindow
ScreenToClient
GetDlgItem
UpdateWindow
DrawFocusRect
GetWindowTextA
InvalidateRect
FillRect
SetRect
CopyRect
IsWindowVisible
SendMessageA
GetWindowThreadProcessId
GetSystemMetrics
SystemParametersInfoA
DrawStateA
wsprintfA
GetClientRect
GetSysColor
SetWindowsHookExA
GetClassNameA
GetWindowLongA
SetPropA
CallNextHookEx
CallWindowProcA
UnhookWindowsHookEx
GetPropA
SetWindowLongA
RemovePropA
GetWindowRect
OffsetRect
InflateRect
GetDC
ReleaseDC

gdi32

LineTo
MoveToEx
DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
Escape
SetBkMode
RestoreDC
SaveDC
GetStockObject
ExtTextOutA
SetBkColor
SetTextColor
TextOutA
GetClipBox
CreateBitmap
GetRgnBox
GetTextColor
GetMapMode
GetBkColor
CreateRectRgnIndirect
DeleteDC
SelectObject
CreatePen
CreateSolidBrush
RoundRect
GetTextExtentPoint32A
CreateFontIndirectA
GetObjectA
GetDeviceCaps
SetMapMode
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx

shell32

ShellExecuteA

comctl32

_TrackMouseEvent

shlwapi

PathStripToRootA
PathFindExtensionA
PathFindFileNameA
PathIsUNCA

oledlg

ord8

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA

wldap32

ord27
ord46
ord41
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord301

ws2_32

bind
ntohs
getsockname
setsockopt
WSAIoctl
htons
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
send
ntohl
htonl

crypt32

CertFreeCertificateContext

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comdlg32

GetFileTitleA

advapi32

RegSetValueExA
CryptImportKey
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt

ole32

OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleFlushClipboard
OleIsCurrentClipboard
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString

Sections

.text
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8bd33656afc728ed43242aa9d72344ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comctl32

shlwapi

oledlg

wininet

wldap32

ws2_32

crypt32

oleacc

winspool.drv

comdlg32

advapi32

ole32

oleaut32

Sections

.text Size: 496KB - Virtual size: 495KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 12KB - Virtual size: 28KB

.rsrc Size: 55KB - Virtual size: 55KB

.reloc Size: 69KB - Virtual size: 68KB

.text
Size: 496KB - Virtual size: 495KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 12KB - Virtual size: 28KB

.rsrc
Size: 55KB - Virtual size: 55KB

.reloc
Size: 69KB - Virtual size: 68KB