f10ad28830dd963479aa88439ec339b2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

f10ad28830dd963479aa88439ec339b2.bin
Size

7KB
MD5

c487837c8a5c5d14441df7b20a753a56
SHA1

10a3182f7cfbf6d317fad8633a6620370a209325
SHA256

e080274c49bc0a2b9c6c248774e5da340ecbc14e03ab81946da57307b596fece
SHA512

a168ea0aa68d8103e49e8f567903444f8ae8ae11a1ec9e153e8922d63938024c80f761808e2f3ddd6b4154d85e298bbbf9e7d27322164f7376f48557dcdeca5d
SSDEEP

192:H6arMMM9RbVtvfzsRulo+0Vv8I4acegF/2+I3:a6qfzsO10JX4acel+I3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b00a0e531c3d0151e1d8e71a4623917b8de03ea510b3c86a4e1c9b13ae078376.dll

Files

f10ad28830dd963479aa88439ec339b2.bin
.zip

Password: infected
b00a0e531c3d0151e1d8e71a4623917b8de03ea510b3c86a4e1c9b13ae078376.dll
.dll windows x86

Password: infected

8576330f9aeb41bf60082dc9f971f9a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCpyNW
StrRChrIA
StrCmpNIW

kernel32

EnumSystemCodePagesW
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime
VirtualProtect

mapi32

ord140
ord80
ord60
ord129
ord198
ord206
ord54
ord196

pdh

PdhLookupPerfIndexByNameW
PdhOpenQueryW
PdhGetRawCounterArrayW
PdhExpandCounterPathW
PdhComputeCounterStatistics

ws2_32

getprotobynumber
WSACloseEvent
accept
WSACancelBlockingCall
WSAJoinLeaf
setsockopt
gethostname
gethostbyname

winspool.drv

ord201
ord203
GetPrinterDriverA
GetPrinterDataExW

shell32

ExtractIconA
SHAppBarMessage

user32

EnumWindowStationsA
WindowFromDC
GetWindowTextLengthA
GetAltTabInfoA
GetActiveWindow
WinHelpA
EnumDisplayMonitors
LoadKeyboardLayoutA

rtm

RtmDequeueRouteChangeMessage
RtmEnumerateGetNextRoute
MgmGetFirstMfe
RtmDeleteRouteTable
RtmGetNetworkCount
RtmCreateEnumerationHandle

Exports

Exports

JKbtgdfd
_AddDays@8
_DaysBetweenDates@8
_GetEasterSunday@8
_GetFirstWeekdayOfMonth@8
_GetLastWeekday@8
_GetLastWeekdayOfMonth@8
_GetNextWeekday@8
_GetNthDayOfWeekInMonth@20
_GetNthWeekdayOfMonth@12
_GetTimeZoneOffsetInMinutes@0
_IsSameWeek@8
_IsWeekend@4
_fDaysInMonth@8

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8576330f9aeb41bf60082dc9f971f9a0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

mapi32

pdh

ws2_32

winspool.drv

shell32

user32

rtm

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 124B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 124B