02db8fda0f42dff7ef9e2e6873b7afd5[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

02db8fda0f42dff7ef9e2e6873b7afd5.bin
Size

118KB
MD5

005f21aa272b282c030f5fef6d598cb6
SHA1

6280cc1ac7c653a4fa4912e7a92f8c70bc857752
SHA256

6685a1335f6a75829249284fec4a0cc5583696400e22b5aa88183df3a13bacd3
SHA512

501bc2b945dd36995a45674708c62ede505d03a4ef8700de56d9d7c91bcdeb460757aea9c25b72e751a18a1339e5c42f8c0b5b66bed94658274b793c30845c1f
SSDEEP

3072:acUjwWvdM1ApaY1BjqwtNhzZvyPY35pZA+QlU89hY:isWvdMapj1VztN5ZH3AlTY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/69b9a78b0ca94a55b97b44af84b8eb47a1669a7ca29f626f38b1d5361c34ede5.dll

Files

02db8fda0f42dff7ef9e2e6873b7afd5.bin
.zip

Password: infected
69b9a78b0ca94a55b97b44af84b8eb47a1669a7ca29f626f38b1d5361c34ede5.dll
.dll windows:6 windows x86 arch:x86

Password: infected

ecea502ae8d6b6cf637b892f3a6b808d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\myapp\CcRemote\bin\server\CcMainDll.pdb

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

shlwapi

SHDeleteKeyA

kernel32

HeapAlloc
GetLocalTime
CreateFileMappingA
GetProcessHeap
MapViewOfFile
LocalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalSize
OutputDebugStringA
CreatePipe
GetStartupInfoA
TerminateProcess
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
lstrcmpiA
QueryDosDeviceA
K32GetProcessImageFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
CreateMutexA
SetErrorMode
OpenEventA
ReleaseMutex
FreeConsole
FlushFileBuffers
HeapSize
SetStdHandle
SetFilePointerEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapFree
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileType
GetStdHandle
HeapReAlloc
LCMapStringW
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
MoveFileExA
GetTickCount
GetSystemDirectoryA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcess
SetLastError
GetModuleFileNameA
CreateDirectoryA
GetDiskFreeSpaceExA
WriteConsoleW
CreateProcessA
LocalReAlloc
RemoveDirectoryA
GetFileSize
LocalFree
GetLogicalDriveStringsA
DeleteFileA
CreateFileA
GetFileAttributesA
GetLastError
LocalAlloc
GetVolumeInformationA
FindClose
SetFilePointer
FindNextFileA
GetDriveTypeA
WriteFile
FindFirstFileA
MoveFileA
ReadFile
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenA
lstrcatA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
EnterCriticalSection
ResetEvent
lstrcpyA
Sleep
CancelIo
ResumeThread
CreateThread
WaitForSingleObject
SetEvent
CloseHandle
TerminateThread
CreateEventA
GetConsoleCP
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetConsoleMode
DecodePointer
UnmapViewOfFile
CreateFileW
GetCPInfo

user32

SetWindowsHookExA
GetKeyNameTextA
GetActiveWindow
CallNextHookEx
LoadCursorA
DestroyCursor
BlockInput
SystemParametersInfoA
SendMessageA
wsprintfA
SetCapture
WindowFromPoint
UnhookWindowsHookEx
keybd_event
MapVirtualKeyA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
GetSystemMetrics
GetCursorInfo
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
mouse_event
ReleaseDC
SetRect
CharNextA
GetDC
SetCursorPos
GetThreadDesktop
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CreateWindowExA
GetUserObjectInformationA
SetThreadDesktop
ExitWindowsEx
CloseDesktop
OpenDesktopA
OpenInputDesktop
InternalGetWindowText
IsWindow
ShowWindow
PostMessageA
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetDesktopWindow

gdi32

CreateDIBSection
SelectObject
DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateCompatibleDC

advapi32

RegOpenKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
StartServiceA
QueryServiceConfigA
EnumServicesStatusA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExA
RegEnumValueA
RegEnumKeyExA
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegCloseKey
RegQueryValueA

shell32

SHGetFileInfoA

winmm

waveInReset
waveOutWrite
waveInGetNumDevs
waveInOpen
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveInStop
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutClose

ws2_32

select
socket
ntohs
connect
recv
htons
setsockopt
WSAStartup
gethostbyname
closesocket
WSAIoctl
WSACleanup
gethostname
getsockname
send

imm32

ImmGetContext
ImmReleaseContext
ImmGetCompositionStringA

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

msvfw32

ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage
ICOpen
ICSeqCompressFrame
ICSeqCompressFrameStart

Exports

Exports

FirstRun
MainRun
ServiceMain
TestFun

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ecea502ae8d6b6cf637b892f3a6b808d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

shlwapi

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

imm32

avicap32

msvfw32

Exports

Exports

Sections

.text Size: 143KB - Virtual size: 143KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 143KB - Virtual size: 143KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 8KB