2e79909bb6212d95a6149535ea8ea36d[.]bin

General

Target

2e79909bb6212d95a6149535ea8ea36d.bin
Size

36KB
MD5

89a8b0db707989e698d1adf7af881a7f
SHA1

0dc69c20e8e51073b830064472bf233e485fd613
SHA256

4bf4e16128e4ae125df0505c33f8f31095a807df689a6427ebefc1488705e632
SHA512

7119cd23b6975238256ef532f1b521d83c37ce70c40dffb56336d23bbdd69f64e259a58b62b592f6e50f1eeec3fff544991bc71e6fb1b22f4bce27908709013a
SSDEEP

768:64QrQ14hMCu4ZenHMte/85cr2m6JPavbE6oMYZuVymRUBTSgZk:lQr9MCfesteEM6laDE6olWtRUZS4k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a9a1931b3dcfc1406c4410ed0ff2eab291a37f3d724f6b1f9f789d838fcf028c.exe

Files

2e79909bb6212d95a6149535ea8ea36d.bin
.zip

Password: infected
a9a1931b3dcfc1406c4410ed0ff2eab291a37f3d724f6b1f9f789d838fcf028c.exe
.exe windows x86

Password: infected

3a9434f58b239851f54aee3bd703bbf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Wow64DisableWow64FsRedirection
Sleep
EnterCriticalSection
LeaveCriticalSection
ReadFile
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
GetFileType
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
HeapFree
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
SetFilePointer
SetFilePointerEx
ReadConsoleW
GetStdHandle
GetStartupInfoW
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetModuleFileNameW
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CreateFileW
CloseHandle
WriteConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
HeapAlloc
HeapReAlloc
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
SetEndOfFile
GetStringTypeW
HeapSize
LCMapStringW

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

3a9434f58b239851f54aee3bd703bbf0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 10KB - Virtual size: 9KB