c064940c6bf88a8cdf62e9d9731aa63b[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

c064940c6bf88a8cdf62e9d9731aa63b.bin
Size

495KB
MD5

35e98194afaed7ffe0dd89aec676dea1
SHA1

6e713a724f5bd4f2489e829141dc815c10e96afe
SHA256

efdf5e2a866e038b63bda21973655d0a0570d8707eab4d54a101e173a207f704
SHA512

dbf32836461f7bfbcb15e5d65c1e152730c04e38a6f82e9cd1f493169c62c9eef48aa9c9b89d35593372d2fefbfb72045b26e6bf1392569bad59c130d472085f
SSDEEP

12288:eB3VjnBZPrqdrQhr4Bo7iZ10uP4kOeKy5FWpI3uKWZ:iFzIrQhrd80VkOeKy5UpuuKWZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aeece75735bd3d83b9f2e7eb464dc7910b9afd25db84379136978f58345dfcbc.exe

Files

c064940c6bf88a8cdf62e9d9731aa63b.bin
.zip

Password: infected
aeece75735bd3d83b9f2e7eb464dc7910b9afd25db84379136978f58345dfcbc.exe
.exe windows:5 windows x86

c85feeb3ed0c4cc2917e107ac534e1cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
GetStringTypeW
WriteConsoleW
SetFilePointer
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
GetConsoleOutputCP
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleMode
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetModuleFileNameA
Sleep
GetTickCount
CloseHandle
GetLastError
CreateFileA
GetConsoleCP
CreateThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapSize
ExitProcess
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
WideCharToMultiByte
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetCPInfo

user32

MoveWindow
GetWindowRect
EndDialog
SendDlgItemMessageA
PostQuitMessage
DefWindowProcA
DestroyWindow
DialogBoxParamA
PostMessageA
EndPaint
LoadBitmapA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
MessageBoxA
LoadAcceleratorsA
LoadStringA
InvalidateRect
BeginPaint

gdi32

SelectObject
TextOutA
DeleteObject
DeleteDC
BitBlt
CreateCompatibleDC

ftd2xx

ord22
ord61
ord4
ord3
ord21
ord15
ord29
ord7
ord8
ord9
ord27
ord71
ord70
ord2
ord23

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 468KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

c85feeb3ed0c4cc2917e107ac534e1cd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ftd2xx

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 468KB - Virtual size: 493KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 468KB - Virtual size: 493KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 6KB - Virtual size: 5KB