mkpub_539459035[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mkpub_539459035.bin
Size

1.8MB
MD5

782b1400e0440af854031fdd1fc48e4f
SHA1

8699ff6719692dae05738ae077a2d191dcdc2f93
SHA256

5a2c9d165017051a3e02009c8c0469f54768305a078e5085f5929a029dd1bf31
SHA512

fa446329eaf438b04a606590d68c0b3996238811b7db99507b9c3a37492511e1ac7f358182f2ce42f6914dd30ac35fcc466ab8b7af18522f21e9f11cdd5e621a
SSDEEP

24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mkpub_539459035.bin

Files

mkpub_539459035.bin
.dll windows:6 windows x86

Password: infected

244d8f9f2c625c07accc7836974657c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcessHeap
CloseHandle
GetComputerNameA
GetLastError
HeapWalk
HeapCreate
TryEnterCriticalSection
CreateActCtxA
ActivateActCtx
CreateThread
GetCurrentProcessId
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
HeapLock

Exports

Exports

DeR8
HUF_inc_var
ITbi4
ObrRM2679
OdAgP61
YiRgp93sN0

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ