184d9d57bd86a97a2beb5e69d2c25a70[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

184d9d57bd86a97a2beb5e69d2c25a70.bin
Size

4.4MB
MD5

3180527d951a617e720e9e94b0bf9a22
SHA1

a8090bc09535d517df1482c015c6056cc12bfb10
SHA256

1741ccdeac379c0bfc9e8b000ff945e146188e14d68e960e9faca247939ea2fc
SHA512

a61e538ca785acd28133a62de1906c60bcf3fdd2dde69e91e427fa4389a6d625ecec2fb95bcc7109166625f96a6595cabd7144bebd42dfb464b65e040c4eb240
SSDEEP

98304:nTz2YW3QSutZgl3qlE95/98kY+zqUugSGlhr0s:n2E7m3qlE91FPSGCs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6ef2d9276b57e028763894984b80014581d61f9c4a1659f83f1bb38b87f12436.exe

Files

184d9d57bd86a97a2beb5e69d2c25a70.bin
.zip

Password: infected
6ef2d9276b57e028763894984b80014581d61f9c4a1659f83f1bb38b87f12436.exe
.exe windows x64

Password: infected

7f080fed612c27be7870afda48c17324

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtCancelIoFileEx
NtCreateFile
RtlNtStatusToDosError
NtDeviceIoControlFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036
RegGetValueW
EventUnregister
EventWriteTransfer
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventRegister
EventSetInformation

ws2_32

getsockopt
recv
ioctlsocket
connect
bind
getpeername
setsockopt
WSAIoctl
WSASocketW
getsockname
send
shutdown
select
getaddrinfo
closesocket
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
WSASend

kernel32

GetTempPathW
GetUserDefaultUILanguage
AcquireSRWLockShared
GetSystemTimeAsFileTime
TlsSetValue
LoadLibraryW
CreateThread
TryAcquireSRWLockExclusive
LCIDToLocaleName
ReleaseSRWLockShared
WriteConsoleW
MultiByteToWideChar
CreateProcessW
GetWindowsDirectoryW
LoadLibraryA
GetSystemDirectoryW
CreateNamedPipeW
GetFullPathNameW
ExitProcess
GetConsoleMode
CreateEventW
CopyFileExW
GetFinalPathNameByHandleW
RemoveDirectoryW
MoveFileExW
DeleteFileW
FindFirstFileW
GetFileInformationByHandleEx
CreateFileW
FindNextFileW
CreateMutexA
WaitForSingleObjectEx
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
WakeAllConditionVariable
GetProcAddress
TerminateProcess
GetExitCodeProcess
GetFileAttributesW
GetModuleFileNameW
GetLastError
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
FreeLibrary
GetEnvironmentVariableW
ReadFileEx
GetCurrentProcess
DuplicateHandle
GetSystemInfo
SleepEx
WriteFileEx
GetStdHandle
CreateDirectoryW
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
SetEnvironmentVariableW
SetHandleInformation
GetEnvironmentStringsW
GetCurrentProcessId
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
FindClose
ReleaseMutex
FreeEnvironmentStringsW
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetFileInformationByHandle
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
TlsFree
GetProcessHeap
HeapAlloc
HeapFree
SetEvent
WaitForSingleObject
GetProcessId
lstrlenW
GetModuleHandleW
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
Sleep
GetModuleHandleA
SleepConditionVariableSRW
CreatePipe
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
InitializeSListHead
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
IsDebuggerPresent
RaiseException
EncodePointer
TlsAlloc
TlsGetValue

user32

CreateIcon
PostQuitMessage
AppendMenuW
CreateMenu
SetMenuItemInfoW
ToUnicodeEx
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
IsWindowVisible
RedrawWindow
AdjustWindowRectEx
GetMenu
GetCursorPos
SystemParametersInfoA
DestroyIcon
GetWindowRect
SendInput
SetForegroundWindow
GetWindowLongPtrW
SetWindowDisplayAffinity
GetWindowTextW
GetWindowTextLengthW
MonitorFromPoint
EnumDisplayMonitors
IsProcessDPIAware
ReleaseCapture
LoadCursorW
SetMenu
GetDC
CreateAcceleratorTableW
ClientToScreen
PostMessageW
IsIconic
DestroyAcceleratorTable
ShowCursor
GetForegroundWindow
GetActiveWindow
GetClientRect
SetWindowPos
ClipCursor
GetClipCursor
SetWindowLongW
SendMessageW
EnableMenuItem
GetSystemMenu
ShowWindow
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
GetKeyboardLayout
InvalidateRgn
SetCursorPos
RegisterClassExW
RegisterWindowMessageA
GetRawInputData
SetCursor
DestroyWindow
EnumChildWindows
DispatchMessageA
SetWindowTextW
MapVirtualKeyW
GetMessageW
GetAncestor
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
GetMonitorInfoW
GetMessageA
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
GetWindowLongW
TrackMouseEvent
MonitorFromRect
TranslateAcceleratorW
GetUpdateRect
ValidateRect
TranslateMessage
DispatchMessageW
PeekMessageW
PostThreadMessageW
DefWindowProcW
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
FlashWindowEx
CheckMenuItem

comctl32

DefSubclassProc
RemoveWindowSubclass
SetWindowSubclass

secur32

EncryptMessage
InitializeSecurityContextW
AcquireCredentialsHandleA
AcceptSecurityContext
ApplyControlToken
QueryContextAttributesW
DecryptMessage
DeleteSecurityContext
FreeCredentialsHandle
FreeContextBuffer

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertAddCertificateContextToStore
CertCloseStore

ole32

CoTaskMemFree
OleInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
RegisterDragDrop
CoTaskMemAlloc
RevokeDragDrop

shell32

SHGetKnownFolderPath
DragQueryFileW
DragFinish
SHAppBarMessage
ShellExecuteW

gdi32

GetDeviceCaps
DeleteObject
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

oleaut32

SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo

api-ms-win-crt-math-l1-1-0

round
__setusermatherr
trunc
floor

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
malloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
exit
_get_initial_narrow_environment
_register_onexit_function
_initterm
_seh_filter_exe
__p___argc
_configure_narrow_argv
_initterm_e
__p___argv
_cexit
_crt_atexit
_c_exit
abort
_register_thread_local_exe_atexit_callback
_exit
_initialize_narrow_environment
terminate
_set_app_type

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
wcslen
_wcsicmp
strlen

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7f080fed612c27be7870afda48c17324

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

bcrypt

advapi32

ws2_32

kernel32

user32

comctl32

secur32

crypt32

ole32

shell32

gdi32

dwmapi

uxtheme

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 16KB - Virtual size: 20KB

.pdata Size: 316KB - Virtual size: 316KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 149KB - Virtual size: 149KB

.reloc Size: 46KB - Virtual size: 45KB

.text
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 16KB - Virtual size: 20KB

.pdata
Size: 316KB - Virtual size: 316KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 149KB - Virtual size: 149KB

.reloc
Size: 46KB - Virtual size: 45KB