970ba6e2a4df8ef10bf1ab57accfe871[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

970ba6e2a4df8ef10bf1ab57accfe871.bin
Size

147KB
MD5

ec6ebba31f059883ecfc8104b8976569
SHA1

8a645b7f4091e752b4587698ea52babfcbbef0f2
SHA256

272f5e62486895140a0588c5d485398b524c2b355da6e333e6440ffb6c97e8fe
SHA512

ef95ec305ca965cc50bf2252e054f154327aafbec6f48490fb7288af4de0bbcee78e576b8358a4d2fda333eb6ab958087f1c53ff7ea976aedcb0b3222c81cd18
SSDEEP

3072:Zx3lERZSau0+Pg0dwn7iDn2m0y6xJaRgLALA6aaZxVQ2Mr:Zx3lmJt+PJnj2RJxQiLVMVQ2U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0cb29154ab6f8b4d5928942f86356b4fbc7f66c296b3cc62fa085af273297bca.exe

Files

970ba6e2a4df8ef10bf1ab57accfe871.bin
.zip

Password: infected
0cb29154ab6f8b4d5928942f86356b4fbc7f66c296b3cc62fa085af273297bca.exe
.exe windows:5 windows x86 arch:x86

Password: infected

c3d91f9f06e670398306893ad7f0764c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\tobava\seharanosi12.pdb

Imports

kernel32

InterlockedCompareExchange
SetComputerNameW
AddConsoleAliasW
GetComputerNameW
GetTickCount
GetNumberFormatA
GetUserDefaultLangID
GlobalFindAtomA
AssignProcessToJobObject
GetSystemPowerStatus
VerifyVersionInfoA
CompareStringW
GetLogicalDriveStringsA
GetLastError
GetProcAddress
FindResourceA
MoveFileW
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
RemoveDirectoryW
SetFileApisToANSI
QueryDosDeviceW
EnumResourceTypesW
CreateWaitableTimerW
GetConsoleTitleW
VirtualProtect
GetFileAttributesExW
DeleteFileW
GetCurrentProcessId
GetFileInformationByHandle
GetVolumeInformationW
VirtualAlloc
GetTempFileNameW
CreateFileA
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
RaiseException
RtlUnwind
HeapAlloc
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
GetConsoleOutputCP
WriteConsoleW
SetStdHandle

gdi32

GetCharABCWidthsFloatW

winhttp

WinHttpReadData

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

c3d91f9f06e670398306893ad7f0764c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

winhttp

Sections

.text Size: 158KB - Virtual size: 157KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 20KB - Virtual size: 73KB

.rsrc Size: 33KB - Virtual size: 33KB

.text
Size: 158KB - Virtual size: 157KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 20KB - Virtual size: 73KB

.rsrc
Size: 33KB - Virtual size: 33KB