bffb2abea1132362f32f92430ea7771d[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

bffb2abea1132362f32f92430ea7771d.bin
Size

564KB
MD5

e7fdd77b21f83fe02dac52d6662acf5c
SHA1

8a694e914fc3778a6d8898fea4e82d72141af869
SHA256

d2c2e6b9723d6b643f4283c34eb4a417e1bb58d3a7f95d960e9a1c72b1957b13
SHA512

1594aad41e6610a5dad9090ea4e667f6e8eaf6c0c8320f3b370d008ba98a3eab948b14c47acdd03b70329db14de06151b6d5277c0a0886a18880c4696d57f357
SSDEEP

12288:CkCFXZ7JR57nCjZUpVwJFrLLZrkReSamo4i2YzSYmfyNSTj4iru:SFXZ7JR5bCjupuJBLLZrkRWmD2mfNTTy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f999d7af5fe48ff638c89bd5e726b42e89c1db97fc6563977523b506f96f05c8.dll

Files

bffb2abea1132362f32f92430ea7771d.bin
.zip

Password: infected
f999d7af5fe48ff638c89bd5e726b42e89c1db97fc6563977523b506f96f05c8.dll
.dll windows:6 windows x86 arch:x86

Password: infected

93ae693c69fb7530eeedaf8107a587ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteValueW
PathRemoveFileSpecA
PathFileExistsA

kernel32

WriteConsoleW
HeapSize
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateFileA
GetFileSizeEx
ReadFile
SetFilePointer
CloseHandle
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateMutexA
Sleep
GetCurrentProcess
TerminateProcess
VirtualProtect
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
K32GetModuleInformation
CreateToolhelp32Snapshot
Process32First
Process32Next
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
WideCharToMultiByte
MultiByteToWideChar
InitOnceBeginInitialize
InitOnceComplete
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetEndOfFile
WaitForSingleObjectEx
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateDirectoryW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
FlushFileBuffers

user32

SetWindowLongA
GetWindowLongA
MessageBoxA
SetWindowPos
CreateWindowExA
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcW
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA

shell32

SHGetKnownFolderPath

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 543KB - Virtual size: 542KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 699KB - Virtual size: 698KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 446KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

93ae693c69fb7530eeedaf8107a587ad

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

version

Sections

.text Size: 543KB - Virtual size: 542KB

.rdata Size: 699KB - Virtual size: 698KB

.data Size: 199KB - Virtual size: 446KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 101KB - Virtual size: 101KB

.text
Size: 543KB - Virtual size: 542KB

.rdata
Size: 699KB - Virtual size: 698KB

.data
Size: 199KB - Virtual size: 446KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 101KB - Virtual size: 101KB