r[.]bin[.]zip | Triage

Sharing

General

Target

r.bin.zip
Size

22KB
MD5

f1321bf5df876cc0ffee512074b02f3e
SHA1

6a23442c158dcef5868d233734df7bb3dad6a62c
SHA256

c363e7cf3bdaf27bea5ae9446f743256623e1acf52482aa62382a5db3de7728d
SHA512

fe3b73a09f89f27197adf2b6fc5d6425ae17e01192d603fe8ee36ce1c453080913451e908537d0960232a5a029217191be7b0844843be4b2cd004780d7939d98
SSDEEP

384:UPfGdEUEJVHwjVaQeuw2vSbiehTm+Iat43U80AmuB3OtVSrCsGdB:sfOEPJVHsz0nTm+RtIrzmu4M4r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/r.bin

Files

r.bin.zip
.zip

Password: infected
r.bin
.exe windows x86

1688500b2e2c447491b53acc8de1652d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetStdHandle
GetModuleFileNameW
HeapReAlloc
HeapAlloc
WriteConsoleW
VerSetConditionMask
GetProcessHeap
FindFirstFileW
FindNextFileW
WriteFile
WaitForMultipleObjects
FindClose
ExitThread
Sleep
GetDriveTypeW
ReadFile
SetFilePointerEx
LoadLibraryA
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateSemaphoreA
ExitProcess

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ