a4f1ea0d81b48d1328bccaa3dc7d2b19[.]bin

General

Target

a4f1ea0d81b48d1328bccaa3dc7d2b19.bin
Size

141KB
MD5

a4f1ea0d81b48d1328bccaa3dc7d2b19
SHA1

b29c94beaa4e9cc4ffdfc043efea4ff48dc9c9e1
SHA256

297e3d063b460078308a5c84bb86b13c9bb878a47d02446b0a1ecc25b690e3eb
SHA512

811f0a33f08a6c1e794be612cb9c2c65ac33bca67527da3908ec0c1839f93846fca5483af52b81ef361843b9605e58dab86257709fd1ddd26b04dfa42f9c17d6
SSDEEP

1536:/suK9aXaNmrSLk8uDbb/+tfR+PSh0ybMqvbIteQNTfkAkox+eM81fIkGl35Fyclo:UTFYDf+F0ybMqTeb5fpk6+lYIZ7GVyU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4f1ea0d81b48d1328bccaa3dc7d2b19.bin

Files

a4f1ea0d81b48d1328bccaa3dc7d2b19.bin
.exe windows:5 windows x86 arch:x86

fc9cc01cf478a61caa8ec04b5a363615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
Sleep
CreateThread
lstrlenW
VirtualProtect
GetProcAddress
LoadLibraryA
VirtualAlloc
GetModuleHandleA
FreeConsole
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

qwxjuhzkjhlkbtre

Sections

.bss
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qbwztn
Size: 68B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc9cc01cf478a61caa8ec04b5a363615

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.bss Size: 9KB - Virtual size: 9KB

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 99KB - Virtual size: 101KB

.qbwztn Size: 68B - Virtual size: 4KB

.bss
Size: 9KB - Virtual size: 9KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 99KB - Virtual size: 101KB

.qbwztn
Size: 68B - Virtual size: 4KB