9f797f1d099263ff19b2aecd09707080[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

9f797f1d099263ff19b2aecd09707080.bin
Size

333KB
MD5

72396b5f782f063181dfac3265e871c2
SHA1

797beb1658669ae1cbbff8f04ace65825f9f6328
SHA256

eaeff67ec779d38ad8e79c2b161ea1bdc5bc2740dd247ccd89e67c26ccf67adb
SHA512

df8125ad37a3b8f16828c7ca94f216cf5e22405cda3ada0319652466acded422abecca76e54c2513c912ef627ad2ce4d3c1c3a5b3ad678080d7d5bd0db3b87fa
SSDEEP

6144:lmPiuw431RXKd4uc3kA8FjpQdR/NKzrJcQW84EfgNOMhkgewVkxNgfKdn:E/31RXlurYPshcQxnG2G6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe

Files

9f797f1d099263ff19b2aecd09707080.bin
.zip

Password: infected
5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe
.exe windows:6 windows x86 arch:x86

Password: infected

f494e9bb2753c3b395b9806eb5f3c320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcA
GetDlgItemTextA
wsprintfA
MessageBoxA
LoadCursorA
GetActiveWindow
CheckDlgButton
SetWindowLongA
GetClassInfoA

kernel32

GetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
VirtualProtect
VirtualAlloc
LoadLibraryA
GetProcAddress
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
FlushFileBuffers
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
DecodePointer
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mRvhW
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 480KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

main
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f494e9bb2753c3b395b9806eb5f3c320

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

Sections

.text Size: 63KB - Virtual size: 62KB

.mRvhW Size: 5KB - Virtual size: 5KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 480KB - Virtual size: 482KB

.reloc Size: 4KB - Virtual size: 3KB

main Size: 3KB - Virtual size: 4KB

.text
Size: 63KB - Virtual size: 62KB

.mRvhW
Size: 5KB - Virtual size: 5KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 480KB - Virtual size: 482KB

.reloc
Size: 4KB - Virtual size: 3KB

main
Size: 3KB - Virtual size: 4KB