253fd863dec01ac27712c2a9d09d1857[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

253fd863dec01ac27712c2a9d09d1857.bin
Size

463KB
MD5

795aedfa5451f5a3cf7536ad8f87340a
SHA1

7e7f8b7ee5864e33c3e05e5dbd0c2ab4def1e878
SHA256

2f67c8e29ff01be93457b653d29226bc542217e7842962f944bfe7fc879f2ec9
SHA512

2e4f03ddda62fe2f4507403f2857a12b8a939b6a572cabe062acc04ba968ae9512b3fc042d97b97730442361b4e773bf9320ee4c9d9510ab9c4788d8e8860a1f
SSDEEP

12288:p0tMmgD49HYe98LyMmEOjwWl+WBzivnICxLn:itB6+3smOWoICxLn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f52faeaf60abc458c02a5e5060b8860ed50e19a1d15c9868d50a29a0cd44de7b.exe

Files

253fd863dec01ac27712c2a9d09d1857.bin
.zip

Password: infected
f52faeaf60abc458c02a5e5060b8860ed50e19a1d15c9868d50a29a0cd44de7b.exe
.exe windows:5 windows x86 arch:x86

Password: infected

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 467KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ