8bfa4c2c1065b105ec80a86f460e0e0221b39610109cc6cd4b441dd86e6b4aef[.]bin[.]sample[.]gz

Sharing

Copy URL Twitter E-mail

General

Target

8bfa4c2c1065b105ec80a86f460e0e0221b39610109cc6cd4b441dd86e6b4aef.bin.sample.gz
Size

277KB
MD5

07257455d5b982333071772e77e6c539
SHA1

525587941d0678a737be4a443c97e7405f2256d1
SHA256

40a621bda7a3f1b61ce1cac4c7c3134e84832dd7e41511663e385d6a26267621
SHA512

430ef779114166f4a66f1d7c70fec2f7a96614ef2de79e7651b46ab98b89153a62a2d0eb4c51c15aac64654848da0788e92addc58673f4804a3795e35c2c8ab2
SSDEEP

6144:BdGg0IWmxEI/fm4QRSGnmORRfj2Rehm/WWzWW7tB0l:D0IWmJ/fm/sSmSRLLhm56UB0l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sample

Files

8bfa4c2c1065b105ec80a86f460e0e0221b39610109cc6cd4b441dd86e6b4aef.bin.sample.gz
.gz
sample
.exe windows:6 windows x64 arch:x64

af9cdca3f45f167a639a6f8934dd7c52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
GetCurrentThreadId
PostQueuedCompletionStatus
CreateEventW
GetLastError
SetFileInformationByHandle
SetEvent
TerminateThread
TlsAlloc
CloseHandle
CancelIoEx
QueueUserAPC
LocalFree
DeleteCriticalSection
SleepEx
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
CreateFileW
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
Sleep
GetSystemInfo
ResetEvent
GetCurrentProcess
GetProcessId
OpenProcess
GetLogicalDriveStringsW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
WaitForMultipleObjects
WriteFile
EnterCriticalSection
SetLastError
TlsSetValue
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
SetWaitableTimer
GetFileSizeEx
GetDriveTypeW
ReadFile
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlPcToFileHeader
RaiseException
GetLocaleInfoEx
GetStringTypeW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
TerminateProcess
RtlUnwindEx
FreeLibrary
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW

advapi32

CryptGenRandom
CryptEncrypt
CryptAcquireContextW
CryptReleaseContext

ole32

CoSetProxyBlanket
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

ws2_32

WSAStartup
WSACleanup

crypt32

CryptDecodeObjectEx
CryptStringToBinaryA
CryptImportPublicKeyInfo

shlwapi

PathIsNetworkPathW

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW

rstrtmgr

RmEndSession
RmShutdown
RmStartSession
RmGetList
RmRegisterResources

Sections

.text
Size: 436KB - Virtual size: 435KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af9cdca3f45f167a639a6f8934dd7c52

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

ws2_32

crypt32

shlwapi

wtsapi32

rstrtmgr

Sections

.text Size: 436KB - Virtual size: 435KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 20KB - Virtual size: 26KB

.pdata Size: 21KB - Virtual size: 20KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 436KB - Virtual size: 435KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 20KB - Virtual size: 26KB

.pdata
Size: 21KB - Virtual size: 20KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB