867ce4c1c762bec122674c8874eb7fc3[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

867ce4c1c762bec122674c8874eb7fc3.bin
Size

753KB
MD5

19bf2d71127ec6038c10768714700409
SHA1

b5681da2fb04b6b80b85b2a96cba2a6d4e55b247
SHA256

b22cdd3e8254bfa99e64f71a383b4b104338943fd1bd36a0b55add5714bee477
SHA512

8d35c90e1037e69cbbd494bbbfb45406451a3ea16cce6f8fa8fd8cccdd42474b24d7178337b544028e0ca894a00ccb42f5f653b44a3e7c0b327e189ec9da1f2b
SSDEEP

12288:dOFpqhhXJsKZ1gIN03DIvs613nhwGnxTzn5k/zjvSWyJbOEaE8+rxD2bUAAgvpFQ:dOrqhhCi1gImDex13nquxpgfD1+1CTAP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f459416f91305ef8ff6bbbfa1a7f017a1da3c0efa4a892468818eb867aa020d0.dll

Files

867ce4c1c762bec122674c8874eb7fc3.bin
.zip

Password: infected
f459416f91305ef8ff6bbbfa1a7f017a1da3c0efa4a892468818eb867aa020d0.dll
.dll windows x86

Password: infected

12f9017f7f8e235223d21864526d7aa6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetKnownFolderPath
ShellExecuteW

ole32

CoTaskMemFree

ntdll

RtlUnwind
NtAllocateVirtualMemory
NtProtectVirtualMemory

user32

ShowWindow
CallWindowProcW
FindWindowW
SetWindowLongW
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
FlashWindowEx
GetClientRect
GetDC
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
GetKeyState
IsChild
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetCursorPos

kernel32

GetTimeZoneInformation
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetCurrentProcess
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
FreeLibraryAndExitThread
CreateThread
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsValidCodePage
InitializeSListHead
TerminateProcess
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetLastError
MoveFileExW
GetFileInformationByHandleEx
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReadFile
GetACP
GetOEMCP
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
GetSystemTimeAsFileTime
LoadLibraryExW
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

gdi32

SelectObject
GetFontData
EnumFontFamiliesExW
DeleteObject
DeleteDC
CreateFontW
CreateFontA
CreateCompatibleDC

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

12f9017f7f8e235223d21864526d7aa6

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ole32

ntdll

user32

kernel32

imm32

gdi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 175KB - Virtual size: 175KB

.data Size: 5KB - Virtual size: 44KB

_RDATA Size: 10KB - Virtual size: 9KB

.reloc Size: 35KB - Virtual size: 34KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 175KB - Virtual size: 175KB

.data
Size: 5KB - Virtual size: 44KB

_RDATA
Size: 10KB - Virtual size: 9KB

.reloc
Size: 35KB - Virtual size: 34KB