1ff3761d62cc5ee7c888a8c1bdd9d1ac[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

1ff3761d62cc5ee7c888a8c1bdd9d1ac.bin
Size

405KB
MD5

b95f93b016b90a03a118642613601807
SHA1

18d278ead689dc9b612d763b7680b79fb2257cbf
SHA256

bec6228157ea77b37b4e021cceba5002f587b3461677bf18b93fd5d29fa6403e
SHA512

101f191969dff62c80b96e490e6d1118b842067fcd489d37615fecdd4a14207a5c34280b969be56735fb6d7e3c4b443754b184ef391d4c877d8af038e4abb3b8
SSDEEP

12288:I4+/Uf8cuMXKJsCmOKG/BgFX8zdHR7mUIfoBO:I4LpIp66zvmU9Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f8a1d78eb7691f90053a5d7ad70588bed4c4a5cdd7bc949c368d8c2bc62f95c4.dll

Files

1ff3761d62cc5ee7c888a8c1bdd9d1ac.bin
.zip

Password: infected
f8a1d78eb7691f90053a5d7ad70588bed4c4a5cdd7bc949c368d8c2bc62f95c4.dll
.dll windows x86

Password: infected

34188f9790f1e6bd6924e17658a1d977

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
WriteFile
CloseHandle
GetComputerNameA
GetCurrentActCtx
CreateFiber
SwitchToFiber
CreateActCtxA
ActivateActCtx
DeactivateActCtx
CreateThread
ResumeThread
OpenThread
GetTempPathA
LockFile
UnlockFile
SetEndOfFile
ReleaseActCtx
CreateNamedPipeA
WaitNamedPipeA
VirtualAlloc
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStringTypeW
GetLastError
SetLastError
MultiByteToWideChar
GetACP
EncodePointer
DecodePointer
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
IsValidCodePage
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
RaiseException
RtlUnwind
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
CreateFileW

Exports

Exports

JfQVjr71
RHV0d6
StartDll

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 459KB - Virtual size: 461KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

34188f9790f1e6bd6924e17658a1d977

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 84KB

.rdata Size: 250KB - Virtual size: 249KB

.data Size: 459KB - Virtual size: 461KB

.gfids Size: 512B - Virtual size: 68B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 85KB - Virtual size: 84KB

.rdata
Size: 250KB - Virtual size: 249KB

.data
Size: 459KB - Virtual size: 461KB

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB