18baedf43f4a68455e8d36b657aff03c.bin
- SHA256 80a8fca48762863e3b433253adad16545130d1eadcb3d972f952ed62a82f6f11
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 18baedf43f4a68455e8d36b657aff03c.bin
- Size 105KB
- Sample240110-bhfmpscbd7
- SHA256 80a8fca48762863e3b433253adad16545130d1eadcb3d972f952ed62a82f6f11
- MD5 b47b842d5840de6235d5e5b29ceb5c71
- SHA1 ebbe901a4bbcc91a2a25ff4557e9ed9ccf62ee03
- SHA512 e8111495fc02dcf23e0c1989731419ef91099f791cf5d622fb87933257fbb6bf0feb36239bc5e4aaa6eb30852f16ea104cbd349648ce78f8d58a74fb4bc62e41
- SSDEEP 3072:GgVBYpFz7SuX0jdfBdtoX+fED9vdTVhcu:GgD0Suk5TeXsEvdVhcu
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
File Explorer
-
18baedf43f4a68455e8d36b657aff03c.bin.zip 105KB
-
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe.exe 216KB
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
- IMPHASH e368d6bc3e0ef21bbf5b85202694f447
- SHA256 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc
- MD5 18baedf43f4a68455e8d36b657aff03c
- SHA1 5770b7c3931f6ed12650ad27b7fb2bf0752b80dc
- SHA512 3c3161e2b209b7589be33be288076af6b0e81c000ab66f7eb184ce54114b7e4687cc33e95bc9daf8b61394d8f847f85858bf0c978dbf829c0cd1fd9620231d4e
- SSDEEP 3072:h17DaAz38w3vQ7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Fb8JF6Pf2KQ+aVB2fJqh4Id
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
122460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LoadLibraryA
GlobalAlloc
Process32FirstW
GlobalFree
SetVolumeMountPointW
GetProcAddress
GlobalLock
FindVolumeClose
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
GetTickCount
GlobalUnlock
lstrcmpW
GetDriveTypeW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
GetCommandLineW
FindNextFileW
WaitForMultipleObjects
OpenProcess
HeapAlloc
CreateMutexA
GetFileAttributesW
ExitThread
SetFileAttributesW
OpenMutexA
lstrcatW
GetSystemInfo
CreateThread
SetFilePointerEx
MoveFileExW
ExitProcess
GetCurrentProcessId
lstrcpyW
GetSystemTime
lstrcmpiW
RtlVirtualUnwind
WriteConsoleW
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
GetModuleHandleA
GetTempPathW
TerminateProcess
GetCurrentProcess
FindFirstVolumeW
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
EnterCriticalSection
SetProcessShutdownParameters
GetProcessHeap
HeapFree
FlushFileBuffers
IsProcessorFeaturePresent
DeleteCriticalSection
CloseHandle
CreateFileW
lstrlenA
InitializeCriticalSection
LeaveCriticalSection
WriteFile
lstrlenW
TryEnterCriticalSection
FindClose
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
CompareStringW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
QueryPerformanceFrequency
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetFileType
user32
DrawTextA
SystemParametersInfoW
wvsprintfW
wsprintfW
GetDC
FillRect
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDIBits
DeleteDC
SetTextColor
GetObjectW
DeleteObject
advapi32
OpenServiceA
CryptReleaseContext
EnumDependentServicesA
RegCloseKey
CloseServiceHandle
OpenSCManagerA
ControlService
RegSetValueExW
RegOpenKeyExW
QueryServiceStatusEx
CryptAcquireContextW
CryptGenRandom
shell32
ShellExecuteW
SHEmptyRecycleBinA
CommandLineToArgvW
netapi32
NetApiBufferFree
NetShareEnum
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
mpr
WNetGetConnectionW
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
Name
.text
Size
197KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=139, id=261, version=27412,
count=37, id=261, version=30625,
count=16, id=260, version=30625,
count=9, id=259, version=30625,
count=17, id=257, version=27412,
count=170, id=1, productName=Unmarked objects,
count=8, id=265, version=30705,
count=1, id=259, productName=VS2022 v17.0.0 pre 7.0 build 30705, version=30705,
count=1, id=255, productName=VS2022 v17.0.0 pre 7.0 build 30705, version=30705,
count=1, id=258, productName=VS2022 v17.0.0 pre 7.0 build 30705, version=30705,