eb78e2d0314c7a1f07ea7e2c31b9d64d[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

eb78e2d0314c7a1f07ea7e2c31b9d64d.bin
Size

161KB
MD5

d5fb578cb42a38761e475b2b7c539a5c
SHA1

4729ec9871fd87bbe97780481e522cb58e4ff3fc
SHA256

34a88449e9e4f12eb7c956f1d37b6541650ffd012d24a065e8d603c76d6a8da3
SHA512

01ce0f956471bdaa23a00b39750de011380cf73d2245f22144a3bad0c1c2fabfe3bcc8ca2a7b253eb565e4a398a30afe923cf2385832fe462c605d56c8c89375
SSDEEP

3072:PaGI/jmaDmV8SlDkQ2HyJ+39FmfNqNaGQQpyPReulsSPhqM8JUf2VBP6es:P1I/0V8UOX39MwNaGQFeulsSPwVUus

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/24983fd8572724a73e3003f3ad9febe5513a6dba4d8b8b2fb996906aa557d063.bin

Files

eb78e2d0314c7a1f07ea7e2c31b9d64d.bin
.zip

Password: infected
24983fd8572724a73e3003f3ad9febe5513a6dba4d8b8b2fb996906aa557d063.bin
.exe windows:5 windows x86

c6ca54cd6e670e7ae3e297db42de48d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
GetDateFormatW
FillConsoleOutputCharacterA
FindResourceA
WritePrivateProfileStructA
PeekNamedPipe
TlsGetValue
GetLocaleInfoA
GetProfileIntW
UpdateResourceA
_lwrite
InterlockedDecrement
HeapFree
FindCloseChangeNotification
SetCommBreak
ConnectNamedPipe
GetTickCount
GetCurrentThread
GetConsoleAliasesA
LoadLibraryW
WriteConsoleOutputA
GetNamedPipeInfo
GetCompressedFileSizeA
CreateActCtxA
DisconnectNamedPipe
GetConsoleAliasesW
GetLastError
GetProcAddress
VirtualAlloc
SearchPathA
SetFileApisToOEM
LoadLibraryA
OpenMutexA
FoldStringA
EnumResourceTypesW
GetOEMCP
QueryMemoryResourceNotification
HeapSetInformation
CancelTimerQueueTimer
Module32Next
ReadConsoleInputW
GetWindowsDirectoryW
ResetWriteWatch
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
GetACP
IsValidCodePage
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapAlloc
HeapCreate
VirtualFree
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileA
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
SetEndOfFile
GetProcessHeap
ReadFile

user32

LoadMenuA
CharUpperBuffA
CharLowerBuffA
CharToOemBuffA

Sections

.text
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 31.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

c6ca54cd6e670e7ae3e297db42de48d4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 182KB - Virtual size: 181KB

.data Size: 7KB - Virtual size: 31.9MB

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 182KB - Virtual size: 181KB

.data
Size: 7KB - Virtual size: 31.9MB

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 42KB - Virtual size: 41KB