11454c4445776c8f03fa68f231522decbe191404c1e8309df357b45b58c2bd84[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

11454c4445776c8f03fa68f231522decbe191404c1e8309df357b45b58c2bd84.bin.sample.gz
Size

50KB
MD5

2189787a3018e23506665684a2b0fa5c
SHA1

d5faef120576d159c5a3e9e528ffdf1258704e46
SHA256

2b86a1d62e2acd1093d0ccb412c638b2a1cff43704aaf1d563c4c1b5e218ea6a
SHA512

d55d42e0daae8a0bb5851210c05614df9140740d76a3e853dcd6ca28a48c2653f58bade8a304f5fd70ab2de539897ba4c2d767e406badb30a1e74ef18e835806
SSDEEP

768:TAyw80vlemYOfGJL9X7OoRaolnvEvTWfVumpITeQYqocXZc6y4LHp2Jf:M80Nd87Fao1v0SflHQYqocy6y4LJ+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sample

Files

11454c4445776c8f03fa68f231522decbe191404c1e8309df357b45b58c2bd84.bin.sample.gz
.gz
sample
.exe windows:10 windows x64

2081980dd352d52cf670e95d94429f38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_callnewh
??0exception@@QEAA@AEBQEBDH@Z
__uncaught_exception
fseek
_wfsopen
abort
_wcsdup
__crtLCMapStringW
_get_current_locale
_free_locale
fflush
setvbuf
memmove
memcpy
_CxxThrowException
memset
ungetwc
ungetc
fputwc
_ismbblead
fgetwc
fgetc
_errno
___mb_cur_max_func
calloc
___lc_codepage_func
__mb_cur_max
malloc
?what@exception@@UEBAPEBDXZ
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
free
_purecall
??0exception@@QEAA@AEBQEBD@Z
??_V@YAXPEAX@Z
__iob_func
fclose
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
fwrite
fgetpos
__C_specific_handler
_fseeki64
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
___lc_handle_func
setlocale
fsetpos
memcpy_s
freopen
_vsnwprintf
wprintf
__pctype_func
__CxxFrameHandler3

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

CreateEventExW
CreateMutexExW
InitializeCriticalSectionEx
OpenSemaphoreW
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
SetEvent
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
GetStringTypeW
WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsSubstring
WindowsDeleteString

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

api-ms-win-appmodel-state-l1-2-0

CloseState
GetSystemAppDataKey
OpenStateExplicit

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2081980dd352d52cf670e95d94429f38

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-appmodel-state-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 844B

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 844B