mkpub_i_sbc[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mkpub_i_sbc.bin
Size

9KB
MD5

ed7a716082ba3dc98d49e4ecf6eda9fd
SHA1

983032e9316c8e5e9ad5c5b37eaa5a5f97d49b8c
SHA256

16b46a0536499e6b0f03296374d782b11d0c0393dd9403afbe507e8a0ef0979f
SHA512

677b7d114490db6596f3cff76c33cc5736189ad34c40e5a24f3aed2ecb4c4bf4048c1624b7c7d831e11b303e6c8b4fd985209b927df813fd5ba5957f9307c342
SSDEEP

96:kbzB1sIGNT8dfY4zbQbxkKYcsMWQAMIwcG9g5vOPEZ1eLP5FOzCVGSBXNBL7Ksex:kbF1PkUfY8LKMp5jeEZ1eLxkWksnK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mkpub_i_sbc.bin

Files

mkpub_i_sbc.bin
.exe windows:4 windows x86

Password: infected

765650190224c30d988bfe1c70e8de98

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

CreateFileA
CreateThread
ExitProcess
FileTimeToSystemTime
GetCurrentProcess
GetLocalTime
GetTempPathA
GetVolumeInformationA
CreateEventA
LocalFree
SetEvent
SetFilePointer
CloseHandle
SystemTimeToFileTime
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
LocalAlloc
Sleep

advapi32

OpenProcessToken
GetTokenInformation
GetSidSubAuthority

wsock32

WSAStartup
closesocket
connect
htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoInitialize
CoCreateInstance
CoUninitialize

secur32

GetUserNameExW
GetUserNameExA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ