ea11d0630e80d6352a12d2f6038e10cf[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

ea11d0630e80d6352a12d2f6038e10cf.bin
Size

221KB
MD5

3449f293d46406613ec0e208d482d4fd
SHA1

a863ae1ffc6e03cc7f95028e6f8b4abfddb4d1de
SHA256

28ac12c1817b82184216182b2404c881c84ffa69273c51e1f8b316799d796dde
SHA512

5edb7bcd205a1d946fa332cab9b8034a3fa16eac8a4b729d78ff8bca28ac46950022ded07b94d1b8d4d3f953cf7867747975ec305a9e5277b0b00d741b32881a
SSDEEP

6144:oUwtI4F0kiWjH8Ekns2vE8vIrPUSp/NL7c:lwvFxNj1gs2adFI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2b21d02167f4e5bb4754d83bf9d69bcbd09b5a1507ab8045eaefb1980ecb989f.exe

Files

ea11d0630e80d6352a12d2f6038e10cf.bin
.zip

Password: infected
2b21d02167f4e5bb4754d83bf9d69bcbd09b5a1507ab8045eaefb1980ecb989f.exe
.exe windows x64

Password: infected

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

kernel32

GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
CreateMutexW
lstrlenA
MultiByteToWideChar
ReleaseMutex
GetVersionExW
GetSystemDefaultUILanguage
Sleep
CloseHandle
WriteFile
lstrlenW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RegisterApplicationRestart
HeapSetInformation
DeleteFileW
GetTempPathW
FreeLibrary
WideCharToMultiByte
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
RaiseException
GlobalDeleteAtom
GlobalAddAtomW
GetLastError
GetCurrentThreadId
SetLastError

gdi32

CreateCompatibleBitmap
CreatePen
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
GetStockObject
Rectangle
SelectObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetLayout
GetClipRgn
SelectClipRgn
GetObjectW
CreatePolygonRgn
OffsetRgn
FillRgn
PatBlt
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
SetLayout
CreateSolidBrush

user32

MapWindowPoints
GetMonitorInfoW
CopyRect
UnregisterClassA
DeferWindowPos
BeginDeferWindowPos
SetCursor
GetIconInfo
GetWindowTextW
CallWindowProcW
DrawIconEx
OffsetRect
GetWindowRgnBox
UnregisterHotKey
GetWindowLongW
GetForegroundWindow
DestroyMenu
CheckMenuRadioItem
GetSystemMetrics
IsWindowVisible
ShowWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetWindowLongPtrW
SetWindowLongPtrW
BeginPaint
LoadMenuW
SetCapture
ReleaseCapture
UnionRect
InvalidateRect
GetPropW
SetPropW
IntersectRect
EnumDisplayMonitors
IsIconic
PtInRect
GetWindow
LogicalToPhysicalPoint
SetRect
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
LoadAcceleratorsW
GetWindowRect
TranslateAcceleratorW
LoadStringW
CreateWindowExW
AdjustWindowRect
RegisterHotKey
DestroyWindow
MonitorFromWindow
EndDeferWindowPos
LoadIconW
GetSubMenu
LoadImageW
SetClassLongPtrW
SetWindowTextW
IsZoomed
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
GetClientRect
DrawFocusRect
DrawTextW
GetProcessDefaultLayout
TrackPopupMenuEx
SetScrollInfo
GetScrollInfo
SetFocus
DefWindowProcW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
AdjustWindowRectEx
InflateRect
FillRect
SendMessageW
EndDialog
GetDlgItem
GetDC
SetForegroundWindow
OpenIcon
FindWindowW
MessageBoxW
GetSysColor
SetWindowPos
GetWindowDC
GetDesktopWindow
PostQuitMessage
SystemParametersInfoW

msvcrt

__CxxFrameHandler3
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
free
_vsnwprintf
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
_wcsicmp
memcpy_s
wcscspn
wcsspn
memmove_s
malloc
_resetstkoflw
strstr
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
memset
__C_specific_handler
vswprintf_s
_CxxThrowException

ntdll

WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
WinSqmIsOptedIn

gdiplus

GdipSaveImageToStream
GdipMeasureString
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipCreateFontFromLogfontW
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawString
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipGetImageEncoders

comctl32

ImageList_Create
ImageList_Add
ord380
ImageList_Destroy
ord345
InitCommonControlsEx

shlwapi

UrlCreateFromPathW
PathFindExtensionW
StrStrA
PathIsURLW
StrChrW
ord487
PathFindFileNameW
ord158
SHRegGetUSValueW
PathRemoveExtensionW

shell32

ShellAboutW
ord75
SHCreateItemInKnownFolder

ole32

CoTaskMemFree
StringFromCLSID
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
VarBstrCat
SysAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysFont
GetThemeSysColor

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 165KB - Virtual size: 165KB

.data Size: 1024B - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 246KB - Virtual size: 246KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.data
Size: 1024B - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 246KB - Virtual size: 246KB

.reloc
Size: 1KB - Virtual size: 1KB