96f646a4b18898abc40f56ecfa685aaa[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

96f646a4b18898abc40f56ecfa685aaa.bin
Size

344KB
MD5

b821b15f69f3655d341abfcad62b991e
SHA1

781a8ce1f4162a8a589da319350a54a4dc569b72
SHA256

f44aa15bacb391b94d61532b246ee0c919c9c4e3ec512532e13af888ab49d928
SHA512

98493ec8724f609f4a26f4c03f3a3f2f7ccac6488123046ba578d018ddc8f58374e0b1a2ee29a5246f2f4d52e8114607a6edf2aa25abee67854c493ae746363f
SSDEEP

6144:YBl+gA5UY3ceTS+Oh+KkqewwjN4eIkXxpq1AILjnhP6Vy4zqOkigh+Tszlbpq+fj://ce5OL7UlRXKmuPw0tzlYq9x3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0c45069bb632d3b998f8bb77929b491d4b1c62f89b4b907480b259e2507650c1.exe

Files

96f646a4b18898abc40f56ecfa685aaa.bin
.zip

Password: infected
0c45069bb632d3b998f8bb77929b491d4b1c62f89b4b907480b259e2507650c1.exe
.exe windows:5 windows x86 arch:x86

Password: infected

9120df538249dfc4533ca001de4a611e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\velulozime70 zuc\biraseyituk\sujajuheyi8-mazab.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
GetSystemDefaultLCID
GetTickCount
GetConsoleTitleA
EnumResourceTypesA
FatalAppExitW
WriteConsoleW
GetModuleFileNameW
FindNextVolumeMountPointW
CreateJobObjectA
GetLogicalDriveStringsA
GetLastError
GetProcAddress
SetComputerNameExA
VirtualAlloc
MoveFileW
GetConsoleDisplayMode
LoadLibraryA
LocalAlloc
GetNumberFormatW
RemoveDirectoryW
GlobalFindAtomW
GetModuleHandleA
GetFileAttributesExW
GetCurrentProcessId
AddConsoleAliasA
ReadConsoleOutputCharacterW
DeleteFileA
AttachConsole
SetVolumeLabelA
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
RtlUnwind
HeapAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
RaiseException

gdi32

GetCharABCWidthsFloatA

Sections

.text
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 38.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

9120df538249dfc4533ca001de4a611e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

Sections

.text Size: 339KB - Virtual size: 338KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 10KB - Virtual size: 38.8MB

.rsrc Size: 30KB - Virtual size: 30KB

.text
Size: 339KB - Virtual size: 338KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 10KB - Virtual size: 38.8MB

.rsrc
Size: 30KB - Virtual size: 30KB