1f1d07d867e9e2b394f49a44f074a84e[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

1f1d07d867e9e2b394f49a44f074a84e.bin
Size

204KB
MD5

284d330dd770ce3c35adc3c7738b5171
SHA1

593e2bd6e9ce9e20a5f1d14e499c3d2bcf59a802
SHA256

6653a07264ea47519fe84f9e24fae0642e3ec3a475ea627d37e4d2c771160c85
SHA512

8e1954fa9fd8f4b122d5ad2bee6fb81e1e11ea2b46e563f620b8d0b619cfb531d1b74ba037e14b93ea589eefe90d44a8330e06ef02bc0b29922eb0ffe1099e65
SSDEEP

6144:rgM012Lnsn/YH8wR2ilCZzNnL+k0f2+JCUFGIgj:8xuQ/YbPuhKkB+AUcj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/151d7008edac758ba7abc7236d3b5a0e4b5170f8b49fb4b1796acfa5118b5030.exe

Files

1f1d07d867e9e2b394f49a44f074a84e.bin
.zip

Password: infected
151d7008edac758ba7abc7236d3b5a0e4b5170f8b49fb4b1796acfa5118b5030.exe
.dll windows:6 windows x64 arch:x64

Password: infected

3e6aeeb525e6f1456c4407279f09b8ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
WriteProcessMemory
GetProcAddress
LoadLibraryW
OutputDebugStringW
WriteConsoleW
CreateFileW
ReadConsoleW
ReadFile
CloseHandle
HeapReAlloc
HeapSize
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
LocalFree
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetCurrentThread
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
FlushFileBuffers
WriteFile
RtlUnwind

oleaut32

SetErrorInfo
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
CreateErrorInfo
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysFreeString
SysAllocString
SafeArrayUnlock
GetErrorInfo
VariantChangeType

mscoree

CLRCreateInstance

Exports

Exports

ReflectiveLoader
VoidFunc

Sections

.textbss
Size: - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 471KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 355B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

3e6aeeb525e6f1456c4407279f09b8ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

mscoree

Exports

Exports

Sections

.textbss Size: - Virtual size: 207KB

.text Size: 471KB - Virtual size: 470KB

.rdata Size: 114KB - Virtual size: 113KB

.data Size: 21KB - Virtual size: 29KB

.pdata Size: 28KB - Virtual size: 27KB

.idata Size: 5KB - Virtual size: 4KB

.msvcjmc Size: 1024B - Virtual size: 752B

.00cfg Size: 512B - Virtual size: 355B

_RDATA Size: 1024B - Virtual size: 546B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.textbss
Size: - Virtual size: 207KB

.text
Size: 471KB - Virtual size: 470KB

.rdata
Size: 114KB - Virtual size: 113KB

.data
Size: 21KB - Virtual size: 29KB

.pdata
Size: 28KB - Virtual size: 27KB

.idata
Size: 5KB - Virtual size: 4KB

.msvcjmc
Size: 1024B - Virtual size: 752B

.00cfg
Size: 512B - Virtual size: 355B

_RDATA
Size: 1024B - Virtual size: 546B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB