18fc2d46c5c937853e599e80e7c6afb1[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

18fc2d46c5c937853e599e80e7c6afb1.bin
Size

46KB
MD5

a465423022a1b5ca494b8a945e34957d
SHA1

a1610477186b209178a101447f290d27ab815687
SHA256

bb63d9203a19d6e26b62e81befc8ed8f816561fbc5c3b12e1bd686d23c6f76ae
SHA512

6460a873e58e2e1b13836ea9198bef344613a23073ad4e27838601e2c2ebfeb55a9b799ece06bcc11d69c06a19e4eb011cf03f10606e66529700cbc7ef4306c7
SSDEEP

768:oCt74EJKF9n82gKdMve/t6zp0nGilMRmWhQDRZyzZhhVTxwarMrVMxVF:1pzKF9n8DiMG/gcGdNCuzpVTxwar1x3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3f8496d9d21f1492cd3b019852accb97e3fa65b785a627d5f0f1e00484ec9c1c.dll

Files

18fc2d46c5c937853e599e80e7c6afb1.bin
.zip

Password: infected
3f8496d9d21f1492cd3b019852accb97e3fa65b785a627d5f0f1e00484ec9c1c.dll
.dll windows x86

Password: infected

d8c268b35825adf780974f5fe02ef180

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmConfigureIMEA
ImmGetRegisterWordStyleA
ImmUnlockIMC
ImmGetCandidateListCountW

kernel32

CreateFileW
SetFilePointerEx
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
K32GetProcessMemoryInfo
EnumSystemCodePagesW
VirtualProtect
GetCurrentProcess
Sleep
GetDiskFreeSpaceExW
CloseHandle
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapFree
HeapAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DecodePointer

wininet

CreateUrlCacheContainerW
InternetQueryDataAvailable
ShowX509EncodedCertificate

ws2_32

WSAIsBlocking
WSARemoveServiceClass
WSACleanup
WSAAsyncGetHostByAddr
WSAGetQOSByName
shutdown

resutils

ResUtilSetPrivatePropertyList
ResUtilVerifyService
ResUtilVerifyResourceService
ResUtilFreeParameterBlock

gdi32

SetBoundsRect
AnimatePalette
GdiGetPageCount
RemoveFontMemResourceEx
EnumFontsW
SetWindowExtEx
Pie

rtutils

TracePrintfExA
TraceVprintfExW
MprSetupProtocolFree

user32

RealGetWindowClassW
GetDlgItemTextW
SetClassLongW
GetPriorityClipboardFormat
DlgDirSelectComboBoxExW
DestroyWindow

winspool.drv

FindNextPrinterChangeNotification
DevQueryPrint
ord208
ord202
AddFormA
WaitForPrinterChange

rtm

MgmGetFirstMfe
MgmTakeInterfaceOwnership
RtmGetNetworkCount

pdh

PdhCloseQuery
PdhOpenQueryW
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue

Exports

Exports

JKbtgdfd
_GetCPUUsage@0
_GetDiskIOUsage@0
_GetDiskUsage@0
_GetMemoryUsage@0
_GetNetworkUsage@0

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d8c268b35825adf780974f5fe02ef180

Headers

DLL Characteristics

File Characteristics

Imports

imm32

kernel32

wininet

ws2_32

resutils

gdi32

rtutils

user32

winspool.drv

rtm

pdh

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB