b5809919bf718e8a3bc9013c053ed8a5[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

b5809919bf718e8a3bc9013c053ed8a5.bin
Size

714KB
MD5

b5809919bf718e8a3bc9013c053ed8a5
SHA1

1fd841f07a7bde5a2df0941ff99573f5d8b52be1
SHA256

a8029680a25fb0144c20fe7637492bcab3c3b320b824735bb02d10babed9c938
SHA512

270f3f20d488778c03f1204d9ab762f4bbceab9230a50cc497bd2edbe02b8838ad9b0a3d4a16b0a8f0fc69d72ec296b0cfbeb54186c8db8f3ef157f5709cb574
SSDEEP

12288:W/AyOoQX8iDg7XSYsfmkFM8TPj1/FsNbRTVHxoocuRQ5n0N:SAoQXpDSEf88T7sNbRT1xdcusg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5809919bf718e8a3bc9013c053ed8a5.bin

Files

b5809919bf718e8a3bc9013c053ed8a5.bin
.exe windows:6 windows x64 arch:x64

325937cd08349ace71117f2d379f2220

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

gethostname
ntohl
htonl
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup

wldap32

ord217
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

normaliz

IdnToAscii

kernel32

HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapFree
GetConsoleCP
GetConsoleMode
ExitProcess
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
ReadConsoleW
FreeEnvironmentStringsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetEnvironmentVariableW
FindClose
CreateFileA
CloseHandle
WideCharToMultiByte
GetTickCount
LoadLibraryW
GetProcAddress
GetCommandLineW
MultiByteToWideChar
Sleep
LocalFree
ReadFile
WriteFile
GetModuleFileNameW
SetFilePointer
GetStartupInfoW
GetCurrentDirectoryW
GetLastError
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
GetCPInfo
GetStringTypeW
GetLocaleInfoW
GetProcessHeap
GetFileAttributesExW
SetEndOfFile
HeapSize
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
CreateFileW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetDriveTypeW
LoadLibraryExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
SwitchToThread

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetUserNameA

shell32

CommandLineToArgvW

oleaut32

SafeArrayCreate
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayPutElement
SysAllocString
SafeArrayUnaccessData

winhttp

WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
WinHttpCrackUrl

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

325937cd08349ace71117f2d379f2220

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

crypt32

normaliz

kernel32

advapi32

shell32

oleaut32

winhttp

Sections

.text Size: 514KB - Virtual size: 514KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 25KB - Virtual size: 24KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 514KB - Virtual size: 514KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 4KB - Virtual size: 4KB