11e1ef6454a5b19bd485cc95eb50b6c9[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11e1ef6454a5b19bd485cc95eb50b6c9.bin
Size

650KB
MD5

11e1ef6454a5b19bd485cc95eb50b6c9
SHA1

70eebd780e9ca8ce45983da343fb532eaaa00a8a
SHA256

ef99db978e26c92aa802c6a84816ed634268b4dafd89f38a47e495901db37735
SHA512

6e4d569a868338a85b5ed079b5e915eed352eecd574046d81f1abf4362b2bb2bb8f0a3cd5460d2e0e56e62fb835f5038fe11d3aead76dfc933e05947a15c2294
SSDEEP

12288:neo2qgTLASsIGm0QPRjwU5JeB8StibVQnMwtE8EFhdjg9:+q+ASBzcoeB8StiZQM4SFfg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11e1ef6454a5b19bd485cc95eb50b6c9.bin

Files

11e1ef6454a5b19bd485cc95eb50b6c9.bin
.exe windows:6 windows x64

c0f45b709ea162f76ab4a91181dd48ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

RegisterClassExW

kernel32

GetModuleHandleA

shell32

ShellAboutA

advapi32

RegQueryValueW

Sections

Size: - Virtual size: 639KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 648KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE