04889da884690bd296877a6a2453a715[.]bin

Resubmissions

23-06-2023 03:02

230623-djzhbacg8z 10

23-06-2023 01:00

230623-bcm5lacb9y 10

Sharing

Copy URL

Twitter E-mail

General

Target

04889da884690bd296877a6a2453a715.bin
Size

2.2MB
MD5

cad68cedaf83d0454478ea60d5c5215f
SHA1

ffa6483f764409208ddd7b87114bea9d241c7b9a
SHA256

0f30beb3de8cf1eff1998c8fefc4884e2bcea97b979783f243f6fcf008b32f30
SHA512

27517812f35083a13f9a6421c8ca8be311321c335a60d5e88bb2302eea2d84e324bb8a72e469d826beb3da945e707786aed0ebe8cfd0873f32780df438654a60
SSDEEP

49152:tfNtbDc8+JRGzg9pEZJub2oG4pv28rp43RHpPB7cJS8FUm:tfjDc5DsZJ4vGwp43RlBwVFUm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d1270e29d9a235bb456db76f5c88042eb06964145dd2b31f2ef87d5af1254e57.exe

Files

04889da884690bd296877a6a2453a715.bin
.zip

Password: infected
d1270e29d9a235bb456db76f5c88042eb06964145dd2b31f2ef87d5af1254e57.exe
.dll regsvr32 windows x64

Password: infected

06de7e98768e8ab9a0c67ba3afc79128

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcessHeap
GetLastError
GetFileAttributesA
FindFirstFileA
FindNextFileA
SetCurrentDirectoryA
CreateNamedPipeA
ConnectNamedPipe
VirtualAlloc
CreateMutexA
ReleaseMutex
TransactNamedPipe
GetLocalTime
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
CompareStringW
LCMapStringW
DeleteCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
HeapReAlloc
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
GetModuleFileNameA
FindClose
FindFirstFileExA
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetStdHandle
GetFileType
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW

Exports

Exports

DllRegisterServer

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1013KB - Virtual size: 1012KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

06de7e98768e8ab9a0c67ba3afc79128

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 1013KB - Virtual size: 1012KB

.data Size: 1.4MB - Virtual size: 1.4MB

.pdata Size: 7KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 152B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 1013KB - Virtual size: 1012KB

.data
Size: 1.4MB - Virtual size: 1.4MB

.pdata
Size: 7KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 152B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 4KB - Virtual size: 3KB