GreyEnergyDropper[.]bin | Triage

Resubmissions

24/11/2023, 10:51

231124-mx7khsah7t 8

16/11/2023, 21:30

231116-1cfg7aha41 8

Sharing

Copy URL Twitter E-mail

General

Target

GreyEnergyDropper.bin
Size

216KB
MD5

7a7103a5fc1cf7c4b6eef1a6935554b7
SHA1

94f445b65bf9a0ab134fad2aaad70779eafd9288
SHA256

6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b
SHA512

575d1cb008b360ea8601804ddb980b9be9dc0aa1bcbf732513ba0e7b3afe001072d157fe31cd9c0226ddd3b9bb81d0787fc79ab7a584c885920c574598e915a8
SSDEEP

3072:dCbdDLmZJzkE8Zk5u8ml+b6ARxL2N+yNFUKrbLtLu0bfOELppRev:MLgkE55fsC6yxG+8FbLtLc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GreyEnergyDropper.bin

Files

GreyEnergyDropper.bin
.exe windows:4 windows x86 arch:x86

98d1ad672d0db4b4abdcda73cc9835cb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetLastError
GetProcAddress
HeapFree
HeapAlloc
GetModuleFileNameW
GetProcessHeap
VirtualAlloc
VirtualFree
LoadLibraryA
GetVersionExA
GetStartupInfoW

user32

GetWindowRect

ntdll

DbgPrint

shlwapi

PathFileExistsW

Sections

.text
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ