0317-1[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
0317-1.bin
Size 328KB
Sample231011-3thpzsec88
SHA256 5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca
MD5 bb7da19e0399724519724d44d7c331c7
SHA1 b10fb1c24b1d4187e24ee1be76b6247b862b214c
SHA512 b68e3f3fec30cac41a11a939e0a5e9db2e45574cb31201fb9dd92657cd03edc060df4f7026ce2f1d9617b48ac88769dcb67958aea040684e661be82d0f8f3fd9
SSDEEP 6144:yN/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmUC3qS7e/g1j:y5FCOWGRayW6sAowXFmUy4U
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0317-1.bin

File Explorer

0317-1.bin

.dll 328KB

0317-1.bin

IMPHASH e7125b885fcd1eea77d2881eaaa53c4d
SHA256 5e3bb62b44636f502e387d4c00bd5a7bc1d040332028238ccd812f73e6d859ca
MD5 bb7da19e0399724519724d44d7c331c7
SHA1 b10fb1c24b1d4187e24ee1be76b6247b862b214c
SHA512 b68e3f3fec30cac41a11a939e0a5e9db2e45574cb31201fb9dd92657cd03edc060df4f7026ce2f1d9617b48ac88769dcb67958aea040684e661be82d0f8f3fd9
SSDEEP 6144:yN/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmUC3qS7e/g1j:y5FCOWGRayW6sAowXFmUy4U
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose ReadFile CloseHandle GetProcessHeap GetThreadErrorMode GetCurrentThread GetErrorMode GetLogicalDrives IsDebuggerPresent AreFileApisANSI SwitchToThread GetSystemDefaultUILanguage GetUserDefaultLangID TlsAlloc GetThreadUILanguage GetLargePageMinimum IsSystemResumeAutomatic GetCurrentThreadId GetACP GetCommandLineA GetOEMCP GetUserDefaultUILanguage GetEnvironmentStringsW GetCommandLineW GetSystemDefaultLangID VirtualAlloc GetLastError RaiseException InitializeCriticalSectionEx FindNextFileA MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetModuleFileNameW lstrcmpiW FreeLibrary FreeEnvironmentStringsW IsValidCodePage FindFirstFileExA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers HeapReAlloc HeapSize GetFileType GetStdHandle DeleteCriticalSection GetTickCount64 SetStdHandle WriteConsoleW CreateFileW RtlUnwind DecodePointer HeapAlloc HeapFree GetModuleFileNameA GetModuleHandleExW ExitProcess TerminateProcess GetCurrentProcess TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx

user32

GetClipboardSequenceNumber GetCapture InSendMessage GetClipboardViewer GetKBCodePage CreateMenu GetCursor IsProcessDPIAware GetProcessWindowStation SetProcessDPIAware GetMenuCheckMarkDimensions IsWow64Message GetForegroundWindow GetMessageTime CharNextW GetShellWindow EmptyClipboard CountClipboardFormats

gdi32

GdiFlush

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

ole32

CoFreeUnusedLibraries CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize

oleaut32

VarUI4FromStr

Name

.text

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ