d98aa91f1d78086a3399de00c835bbb2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

d98aa91f1d78086a3399de00c835bbb2.bin
Size

9KB
MD5

e8c181694bbd9a76fcb25537a9240d1a
SHA1

4ab3843f564d960a7d98c589bf7637a4298960ac
SHA256

6d8abf51eef218c5d2fb6f3ad0f097ec813501f33a2da2cc27bb627f9f1a2a49
SHA512

d81a61ff6d3a3dc351b49aba1d84229d2a561b9f800737e374b77e1965523f1c917d3e1c0e87896ec2598be07f687163fc7e8bbdba5f51a0ea0d14e8e992cf6f
SSDEEP

192:bjRb1Pv52FN2PEY8FCc2f9Vu4zPHWqCneaqwA7aBQXMH/MPX0lJe:/91PvYwzO2fLd2FEOBQzGJe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/32d98f96953be847366ddd09f3cb22468beb288b3f728fdce58ea946ca33e579.dll

Files

d98aa91f1d78086a3399de00c835bbb2.bin
.zip

Password: infected
32d98f96953be847366ddd09f3cb22468beb288b3f728fdce58ea946ca33e579.dll
.dll windows x86

Password: infected

8576330f9aeb41bf60082dc9f971f9a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCpyNW
StrRChrIA
StrCmpNIW

kernel32

EnumSystemCodePagesW
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime
VirtualProtect

mapi32

ord140
ord80
ord60
ord129
ord198
ord206
ord54
ord196

pdh

PdhLookupPerfIndexByNameW
PdhOpenQueryW
PdhGetRawCounterArrayW
PdhExpandCounterPathW
PdhComputeCounterStatistics

ws2_32

getprotobynumber
WSACloseEvent
accept
WSACancelBlockingCall
WSAJoinLeaf
setsockopt
gethostname
gethostbyname

winspool.drv

ord201
ord203
GetPrinterDriverA
GetPrinterDataExW

shell32

ExtractIconA
SHAppBarMessage

user32

EnumWindowStationsA
WindowFromDC
GetWindowTextLengthA
GetAltTabInfoA
GetActiveWindow
WinHelpA
EnumDisplayMonitors
LoadKeyboardLayoutA

rtm

RtmDequeueRouteChangeMessage
RtmEnumerateGetNextRoute
MgmGetFirstMfe
RtmDeleteRouteTable
RtmGetNetworkCount
RtmCreateEnumerationHandle

Exports

Exports

JKbtgdfd
_AddDays@8
_DaysBetweenDates@8
_GetEasterSunday@8
_GetFirstWeekdayOfMonth@8
_GetLastWeekday@8
_GetLastWeekdayOfMonth@8
_GetNextWeekday@8
_GetNthDayOfWeekInMonth@20
_GetNthWeekdayOfMonth@12
_GetTimeZoneOffsetInMinutes@0
_IsSameWeek@8
_IsWeekend@4
_fDaysInMonth@8

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8576330f9aeb41bf60082dc9f971f9a0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

mapi32

pdh

ws2_32

winspool.drv

shell32

user32

rtm

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 8KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 124B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 8KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 124B