24dfa038872ef9351ce2c014b07b6f1b[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

24dfa038872ef9351ce2c014b07b6f1b.bin
Size

126KB
MD5

5efea0bcadb3703fbea7e5963b5150b1
SHA1

4bdbef5ddc61e0a4c1189ed571557b17822a1625
SHA256

b7f805efd9560b0b44c71a36c9965ded41dfb6685adf216c5943f77d736a1f25
SHA512

c589535dfcf82416ac43a0952c10c32de8a99f3aef34aa33101fff71a781c2ad9334af7e5460a349f71b2f69578501c86c2cf71b8249a5336b7eac4e6d57f5d9
SSDEEP

1536:ZZSiSnjJ7Xa/kj3IAO23xhG2uJUSZRuQRIdfcuT2i7sxt9EeaEORlWfB5kgEg6pK:ZI9rLSuhGrhyLMcEOnWIgEZpVL44K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/716cf3d14949e2892a8a215c7d97ab4534a35af1ea09321fe8c8bae07ceb3dcf.exe

Files

24dfa038872ef9351ce2c014b07b6f1b.bin
.zip

Password: infected
716cf3d14949e2892a8a215c7d97ab4534a35af1ea09321fe8c8bae07ceb3dcf.exe
.exe windows:5 windows x86 arch:x86

Password: infected

047a2bf1942fbd4e6f60416f0b5161e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\xowesuma-yedurutubaro.pdb

Imports

kernel32

AddConsoleAliasW
GetFileAttributesExA
GetTickCount
GetConsoleTitleA
TlsSetValue
FatalAppExitW
FreeConsole
WriteConsoleW
GetModuleFileNameW
SetComputerNameExW
FindNextVolumeMountPointW
CreateJobObjectA
InterlockedExchange
GetLastError
GetLogicalDriveStringsW
VirtualAlloc
SetVolumeLabelW
RemoveDirectoryA
LoadLibraryA
OpenMutexA
InterlockedExchangeAdd
LocalAlloc
MoveFileA
GetNumberFormatW
GlobalFindAtomW
EnumResourceTypesW
GetModuleHandleA
VirtualProtect
GetConsoleProcessList
ReadConsoleOutputCharacterW
DeleteFileA
GetProcAddress
GetSystemDefaultLangID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapFree
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
RtlUnwind
HeapAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA

gdi32

GetCharABCWidthsFloatA

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

047a2bf1942fbd4e6f60416f0b5161e1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

Sections

.text Size: 119KB - Virtual size: 118KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 10KB - Virtual size: 59KB

.rsrc Size: 36KB - Virtual size: 2.0MB

.text
Size: 119KB - Virtual size: 118KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 10KB - Virtual size: 59KB

.rsrc
Size: 36KB - Virtual size: 2.0MB