641a33d5e95c41f645924c9e071bade4[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

641a33d5e95c41f645924c9e071bade4.bin
Size

229KB
MD5

b851b32031399f83cce83bb1b1dedfe2
SHA1

553606e8f5c1ee62aa75e8f7f5e4dc57d56dd78c
SHA256

0bff0c9aa48020c929582d4f502263535d0a5b422e6f1d3c2f4e83975b6eea1e
SHA512

aca34607cd4062d9af0088bf122554fddb32a59d3d21dd38bde098ea0cc58848e40909fba5870c9424a3351cc4429638c71f7ca646d7adc26297fc90ba80c911
SSDEEP

6144:3BEyT732Qo9J9QZ4O1G04xjh25vgbIioE:3B32QodQZ7G04H25viIXE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0d75f703f25c6bc527f8a969bea1dea350180b7863c0999e002b15aa592b95c4.bin

Files

641a33d5e95c41f645924c9e071bade4.bin
.zip

Password: infected
0d75f703f25c6bc527f8a969bea1dea350180b7863c0999e002b15aa592b95c4.bin
.exe windows x86

Password: infected

a937ee21afc8da8c636807fc65975a17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
CreateThread
GetModuleHandleA
GetProcAddress
EncodePointer
DecodePointer
GetLastError
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
IsProcessorFeaturePresent
HeapSize
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetStdHandle
WriteFile
GetModuleFileNameW
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetCurrentThreadId
GetProcessHeap
FindClose
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
SetStdHandle
SetFilePointerEx
WriteConsoleW
GetTimeZoneInformation
SetEndOfFile
ReadFile
ReadConsoleW
GetFullPathNameA
SetEnvironmentVariableA

Sections

.text
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a937ee21afc8da8c636807fc65975a17

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 337KB - Virtual size: 336KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 7KB - Virtual size: 21KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 337KB - Virtual size: 336KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 7KB - Virtual size: 21KB

.reloc
Size: 26KB - Virtual size: 25KB