where_am_i[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

where_am_i.bin
Size

928KB
MD5

401286bb41cd98effdcdc72d6312ad97
SHA1

bb0bf11fc051c13e62933b06e3b8fd7211987e8c
SHA256

d576f23d8825e6a46d873df3631e9ff19d847837cfe5a749301608dae104ff83
SHA512

64daee3b8b983ef1cc66d93ea519dd25966efc9e33ac994b0049b0fa622ff87432eb95583217fe599aec1328f16a3a67d28a5c5bddcd359babbd670dff0e8028
SSDEEP

24576:hYNQ6SJNIVuLwKpZkrZnrDzqpESQJ+wpQpKJEWE:hYNQ6fYLwKpyV/0ZQJ5pQpKJEWE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
where_am_i.bin

Files

where_am_i.bin
.exe windows:5 windows x86

1b6dee34be0ef35faafcf6b1eadf6737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
LocalAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
CreateFileA
TlsFree
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileSizeEx
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
SetErrorMode
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
Sleep
ExitProcess
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiA
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
CopyFileA
FormatMessageA
LocalFree
lstrlenW
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
CloseHandle
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetCurrentThreadId
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
lstrcmpW
GetVersionExA
FreeResource
LoadLibraryA
GlobalGetAtomNameA
GlobalAddAtomA
MulDiv
lstrcmpA
GlobalReAlloc
GlobalSize
GetCurrentProcessId
GetModuleFileNameA
GetLastError
SetLastError
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
SetFileTime
lstrlenA
GetModuleHandleA
GetProcAddress
GetFileAttributesA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalUnlock
GlobalFree
GlobalAlloc
LocalReAlloc
GlobalLock
GetProcessHeap
OpenMutexA
CreateProcessA
VirtualAllocEx
WriteProcessMemory
QueueUserAPC
ResumeThread
GetSystemDefaultLangID
GetAtomNameA

user32

GetNextDlgTabItem
CreateDialogIndirectParamA
GetMenuStringA
InsertMenuA
DestroyCursor
LoadCursorA
InflateRect
RemoveMenu
CharUpperA
GetSysColorBrush
SetCapture
CreateMenu
WindowFromPoint
GetMenuItemInfoA
SetTimer
KillTimer
GetDCEx
LockWindowUpdate
DestroyIcon
CharNextA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
PostThreadMessageA
DrawIcon
SetWindowRgn
UnregisterClassA
AppendMenuA
DeleteMenu
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
RegisterWindowMessageA
SendDlgItemMessageA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EndDialog
GetScrollInfo
SetScrollInfo
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
GetWindowPlacement
PtInRect
GetWindowRect
IsZoomed
GetSystemMetrics
GetClassNameA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
SetWindowPos
SetFocus
EqualRect
GetDlgItem
SetWindowLongA
GetDlgCtrlID
GetKeyState
LoadIconA
SetCursor
PeekMessageA
GetCapture
ReleaseCapture
LoadAcceleratorsA
SetActiveWindow
IsIconic
InsertMenuItemA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreatePopupMenu
GetClassInfoA
OffsetRect
GetMenu
BringWindowToTop
SetMenu
GetDesktopWindow
GetWindow
ShowWindow
TranslateAcceleratorA
GetTabbedTextExtentA
GetSysColor
EndPaint
BeginPaint
UnhookWindowsHookEx
SetRect
UpdateWindow
EnableWindow
GetClientRect
GetWindowDC
ReleaseDC
ClientToScreen
ScreenToClient
FillRect
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
IsWindowVisible
IsWindow
GetActiveWindow
CopyAcceleratorTableA
SendNotifyMessageA
PostMessageA
IntersectRect
RegisterClipboardFormatA
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetMessageA
GetDC
InvalidateRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
SetParent
DeferWindowPos
GetSystemMenu
InSendMessage
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsClipboardFormatAvailable
IsRectEmpty
SetRectEmpty
CopyRect

gdi32

EnumEnhMetaFile
GetEnhMetaFileHeader
CloseEnhMetaFile
CreateEnhMetaFileA
PlayEnhMetaFileRecord
Polyline
Polygon
DPtoLP
DeleteEnhMetaFile
BitBlt
GetBkColor
GetViewportExtEx
GetWindowExtEx
GetMapMode
CreateCompatibleBitmap
LPtoDP
CreateCompatibleDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
DeleteObject
SelectClipRgn
CreateRectRgn
GetObjectA
GetStockObject
GetEnhMetaFileBits
GetDeviceCaps
CreatePen
CreateSolidBrush
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
CloseMetaFile
DeleteMetaFile
GetCharWidthA
CreateFontA
StretchDIBits
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
CreateDCA
GetViewportOrgEx
Rectangle
PatBlt
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
CopyMetaFileA
GetTextColor
GetRgnBox
CreateEllipticRgn
Ellipse
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextFaceA
GetTextExtentPointA
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
GetWindowOrgEx
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
StartDocA
GetPixel

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW
PathFileExistsA

oledlg

ord3
ord7
ord5
ord8
ord1

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

ClosePrinter
GetJobA
OpenPrinterA
DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

RegSetValueA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

ExtractIconA
DragQueryFileA
SHGetFileInfoA
DragFinish

ole32

OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoTaskMemAlloc
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
CreateBindCtx
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
CoTreatAsClass
OleDuplicateData
CoDisconnectObject
CoGetClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CoUninitialize
CoCreateInstance
OleSetClipboard
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
StringFromCLSID
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleGetClipboard
OleSetMenuDescriptor
CoInitializeEx
StgCreateDocfile
CoTaskMemFree
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
OleCreateFromData
OleLockRunning
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
ReleaseStgMedium
OleSave
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes

oleaut32

SysStringLen
SysAllocStringByteLen
VariantInit
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString
VariantCopy
SysFreeString

Sections

.text
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b6dee34be0ef35faafcf6b1eadf6737

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shlwapi

oledlg

oleacc

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 377KB - Virtual size: 377KB

.rdata Size: 98KB - Virtual size: 96KB

.data Size: 13KB - Virtual size: 28KB

.rsrc Size: 438KB - Virtual size: 437KB

.text
Size: 377KB - Virtual size: 377KB

.rdata
Size: 98KB - Virtual size: 96KB

.data
Size: 13KB - Virtual size: 28KB

.rsrc
Size: 438KB - Virtual size: 437KB