8a9c00e853d12d8d81bb5250b4dfbab4[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

8a9c00e853d12d8d81bb5250b4dfbab4.bin
Size

128KB
MD5

8a9c00e853d12d8d81bb5250b4dfbab4
SHA1

940f4fca47c42c3d7700aca4556c7583625af2d0
SHA256

4b1cfba8e2c04f6feba65418f145b0c13c498b808ac363edb633cd39811cb83b
SHA512

67c0bffc52009d1d3a5aa30b5c80a06a2f11d3f9398714b5dd9049424a3e2e6982065bb1209cb9c0a43dccd5c945ac7d8e99f8f87cf53867c323c5040065367a
SSDEEP

3072:PI935LvzTNq6uzDjxY2KKQ9NxywH8/eKmyky0ix2UcTI:A935LvzIxY2KKQ9Nxywc/eXyIlnE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a9c00e853d12d8d81bb5250b4dfbab4.bin

Files

8a9c00e853d12d8d81bb5250b4dfbab4.bin
.dll windows:5 windows x86 arch:x86

c60549710fc29bc41f76c0bfb9c01e90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ioctlsocket
select
WSAGetLastError
closesocket
socket
shutdown
__WSAFDIsSet
inet_addr
sendto
connect
htons
recv
send
gethostbyname
WSAStartup

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

urlmon

ObtainUserAgentString

kernel32

CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetTempFileNameA
LoadLibraryA
DeleteCriticalSection
GetVersionExA
CloseHandle
GetTempPathA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleExA
SetEvent
Sleep
CreateEventA
ResetEvent
GetModuleFileNameA
OpenProcess
GetTickCount
VirtualProtect
MoveFileExA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
SetFileAttributesA
OpenEventA
CreateRemoteThread
VirtualAllocEx
GetCurrentProcessId
WriteProcessMemory
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushInstructionCache
SetNamedPipeHandleState
WaitForMultipleObjects
InitializeCriticalSection
WriteFile
WaitForSingleObject
FreeLibrary
CreateFileA
lstrcpyA
lstrcmpiA
lstrcatA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
lstrcpynA
CreateEventW
lstrcmpA
GetComputerNameExA
GetLocalTime
MultiByteToWideChar
lstrlenW
lstrcatW
WideCharToMultiByte
GetModuleHandleA
GetCurrentProcess
CreateThread
CreateNamedPipeA

advapi32

CryptExportKey
CryptAcquireContextW
RegOpenKeyA
InitializeSecurityDescriptor
RegDeleteValueA
RegSetValueExA
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegCloseKey
RegEnumKeyA
RegCreateKeyExA
CryptReleaseContext
CryptGetHashParam
CryptImportKey
RegQueryValueExA
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt

wininet

InternetTimeFromSystemTimeA
InternetOpenW
InternetCrackUrlW
InternetReadFile
HttpAddRequestHeadersA
HttpSendRequestW
HttpOpenRequestW
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectW
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetCrackUrlA

dnsapi

DnsFree
DnsQuery_A

ole32

OleInitialize
CoCreateInstance
OleUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

Init

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c60549710fc29bc41f76c0bfb9c01e90

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

psapi

crypt32

urlmon

kernel32

advapi32

wininet

dnsapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 62KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 73KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 63KB - Virtual size: 62KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 73KB

.reloc
Size: 4KB - Virtual size: 4KB