3798e6dae3df606799111b63bf54aad9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

3798e6dae3df606799111b63bf54aad9.bin
Size

673KB
MD5

0a50d452b789709938db24f4fd6f50f9
SHA1

890d1780bd30cd44673d55ffc3dbeffe135b25a2
SHA256

5d0cde618632bfdc747016e7fcd1dd23f719c57ff3564513ce6008a3ae45db68
SHA512

4f990c198b66b1e22c0637eeda28aa34467c02e2dd802c86e6b902ad706f32df10f65177e957518d01102b27b2b43474bd7ea25df0eef532eaafbfad66d38b3a
SSDEEP

12288:Oc1WaEk1XbOTsXGtZPkJllxdPIlmLUTWS5XLVmJ4xBnmx6fOBLkse5JZF0:PUyrOgGylhtUTWS5XLoJ+m6fOlkseY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8e77cf490e5027b35fb25df886b991f9c63f7ecbca64aff34cd599a5ad9c63fd.exe

Files

3798e6dae3df606799111b63bf54aad9.bin
.zip

Password: infected
8e77cf490e5027b35fb25df886b991f9c63f7ecbca64aff34cd599a5ad9c63fd.exe
.exe windows x86

Password: infected

a463a2c6c08e7ffc59f3680d77294ba6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
SetLastError
GetCurrentProcess
OutputDebugStringA
VirtualAlloc
lstrlenA
WaitForSingleObject
GetLastError
CreateFileA
CloseHandle
CreateThread
GetWindowsDirectoryA
HeapAlloc
GetProcAddress
CreateFileMappingA
ExitProcess
VerSetConditionMask
VerifyVersionInfoW
MapViewOfFile
IsDebuggerPresent
CheckRemoteDebuggerPresent
MultiByteToWideChar
GetModuleHandleExW
FreeLibrary
Sleep
LeaveCriticalSection
EnterCriticalSection
VirtualQuery
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcrt

wcsnlen
_iob
strtol
wctomb_s
_XcptFilter
__set_app_type
__getmainargs
_ismbblead
_acmdln
?_set_new_mode@@YAHH@Z
_msize
?terminate@@YAXXZ
___lc_codepage_func
_isatty
fflush
_fileno
_CIlog10
ceil
realloc
_clearfp
_unlock
_lock
_errno
strcpy_s
_controlfp_s
free
__p__commode
_set_fmode
_initterm_e
_initterm
malloc
_callnewh
tolower
strrchr
_amsg_exit
_except_handler4_common
memset
_CxxThrowException
__CxxFrameHandler3
__pctype_func
strnlen
memcpy
memmove

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

jiuoi89
Size: 456KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a463a2c6c08e7ffc59f3680d77294ba6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 131KB - Virtual size: 130KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 2KB - Virtual size: 1KB

jiuoi89 Size: 456KB - Virtual size: 460KB

.text
Size: 131KB - Virtual size: 130KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 2KB - Virtual size: 1KB

jiuoi89
Size: 456KB - Virtual size: 460KB