cbe409693e5f5bf1486d814dd70b60ac[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

cbe409693e5f5bf1486d814dd70b60ac.bin
Size

46KB
MD5

0bd5b0447dccb245336cc6edeb00d268
SHA1

e27917e6d0dc7d342d99990364c0c97b979c5e5f
SHA256

37279e1614f883ad187a100fe4ef17304bd966979e97d95cfb6593a493138af9
SHA512

0ab686a9c93a94ce7a704d38de284dddcf4f9ab563eff485becfa8b257673a0b11cb845c2e90247e43c58addcbd4b484ebd1951508f0a1d7140fc7942119db06
SSDEEP

768:nbgHPEsaJ6/vDBFNmxzhsqPRMhI4w4XKOhPlJ0OPuOZnf+y9clB7WFtleZv3aM:b4csaJ6/7BFkzhVPGhI4bXKmPuEz9sBn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/050fa5410bd0988fd8b99ce12417b5f8d2b58796a11d56882e5adbfd62902dc9.dll

Files

cbe409693e5f5bf1486d814dd70b60ac.bin
.zip

Password: infected
050fa5410bd0988fd8b99ce12417b5f8d2b58796a11d56882e5adbfd62902dc9.dll
.dll windows x86

Password: infected

d8c268b35825adf780974f5fe02ef180

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmConfigureIMEA
ImmGetRegisterWordStyleA
ImmUnlockIMC
ImmGetCandidateListCountW

kernel32

CreateFileW
SetFilePointerEx
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
K32GetProcessMemoryInfo
EnumSystemCodePagesW
VirtualProtect
GetCurrentProcess
Sleep
GetDiskFreeSpaceExW
CloseHandle
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapFree
HeapAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DecodePointer

wininet

CreateUrlCacheContainerW
InternetQueryDataAvailable
ShowX509EncodedCertificate

ws2_32

WSAIsBlocking
WSARemoveServiceClass
WSACleanup
WSAAsyncGetHostByAddr
WSAGetQOSByName
shutdown

resutils

ResUtilSetPrivatePropertyList
ResUtilVerifyService
ResUtilVerifyResourceService
ResUtilFreeParameterBlock

gdi32

SetBoundsRect
AnimatePalette
GdiGetPageCount
RemoveFontMemResourceEx
EnumFontsW
SetWindowExtEx
Pie

rtutils

TracePrintfExA
TraceVprintfExW
MprSetupProtocolFree

user32

RealGetWindowClassW
GetDlgItemTextW
SetClassLongW
GetPriorityClipboardFormat
DlgDirSelectComboBoxExW
DestroyWindow

winspool.drv

FindNextPrinterChangeNotification
DevQueryPrint
ord208
ord202
AddFormA
WaitForPrinterChange

rtm

MgmGetFirstMfe
MgmTakeInterfaceOwnership
RtmGetNetworkCount

pdh

PdhCloseQuery
PdhOpenQueryW
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue

Exports

Exports

JKbtgdfd
_GetCPUUsage@0
_GetDiskIOUsage@0
_GetDiskUsage@0
_GetMemoryUsage@0
_GetNetworkUsage@0

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d8c268b35825adf780974f5fe02ef180

Headers

DLL Characteristics

File Characteristics

Imports

imm32

kernel32

wininet

ws2_32

resutils

gdi32

rtutils

user32

winspool.drv

rtm

pdh

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB