4d95a998f67ff4c580aa190fa5893396[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

4d95a998f67ff4c580aa190fa5893396.bin
Size

381KB
MD5

a8888e66b8ac6e91cb0292b2052ecad7
SHA1

be0845f0c0f17d61306827dac9c5ba9602c699b2
SHA256

d1dd1d703aade2d68d8543272d5c06ade80a532d9de6814d9c1b1e1e24717d98
SHA512

61e2661c0c399b4d79b324765d6eac11953af2000af4c0acacbdc1ca2af6265e7c95a213c4c7d4d82aab9adbaf7bce7297fae6b7f299414f8a67013c18cd6969
SSDEEP

6144:7f5/z7/K6aFboOLhZzmmv/Zm4JQPEIOs9Dyp+sefdM8jEG8WF9YrvXFFPgc6I:b5LzK68bo+mCky4EI+sdfdMzXF1gzI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/32203a8beb112105aeb97a8ac87a25bc11b2299230ff4eb20c9badce9666380b.exe

Files

4d95a998f67ff4c580aa190fa5893396.bin
.zip

Password: infected
32203a8beb112105aeb97a8ac87a25bc11b2299230ff4eb20c9badce9666380b.exe
.exe windows:6 windows x86 arch:x86

Password: infected

8d42dc75ca400c110899cd420e2415df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Administrator\Desktop\GitHub\OpenFRE\Release\OpenFRE.pdb

Imports

urlmon

URLDownloadToFileA

comctl32

InitCommonControlsEx

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetEnvironmentVariableA
SetLastError
FormatMessageW
MoveFileExA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
WaitForSingleObjectEx
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetProcAddress
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
SetEndOfFile
GetFileAttributesExW
FlushFileBuffers
HeapReAlloc
DeleteFileW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetSystemDirectoryA
CompareStringW
GetTimeFormatW
GetDateFormatW
GetOEMCP
FreeLibrary
QueryPerformanceFrequency
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
TransactNamedPipe
LoadLibraryW
VirtualAlloc
GetFullPathNameW
HeapAlloc
HeapFree
GetCurrentDirectoryW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
WriteFile
FreeLibraryAndExitThread
ExitThread
SetFilePointerEx
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlUnwind
VirtualFree
CreateNamedPipeA
GetModuleHandleA
CreateThread
Sleep
GetExitCodeThread
VirtualFreeEx
GetStartupInfoW
IsDebuggerPresent
SetEnvironmentVariableW
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
CreateRemoteThread
VirtualAllocEx
CloseHandle
LoadLibraryA
OpenProcess
GetFullPathNameA
WriteProcessMemory
HeapSize
LCMapStringW
GetCurrentProcess
GetProcessHeap
WriteConsoleW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

GetWindowTextW
EnableWindow
EndPaint
BeginPaint
UpdateWindow
EnableMenuItem
PostQuitMessage
TranslateMessage
DefWindowProcA
RegisterClassA
MessageBoxIndirectA
GetSubMenu
SendMessageW
CreateWindowExW
FillRect
DestroyWindow
LoadCursorA
DispatchMessageA
LoadMenuW
GetMessageA
GetWindowTextLengthW
MessageBoxW
GetWindowThreadProcessId
ShowWindow
FindWindowA

gdi32

GetStockObject

advapi32

CryptAcquireContextA
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext

shell32

ShellExecuteExA
ShellExecuteA

ws2_32

WSACloseEvent
socket
WSAEnumNetworkEvents
recv
closesocket
accept
WSAEventSelect
WSAResetEvent
WSACreateEvent
WSAWaitForMultipleEvents
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
inet_pton
WSAStartup
WSACleanup
ntohl
listen
recvfrom
getaddrinfo
freeaddrinfo
htonl
ioctlsocket
send
gethostname
sendto

crypt32

CertFreeCertificateContext
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
PFXImportCertStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptStringToBinaryA
CryptDecodeObjectEx
CertGetCertificateChain
CertFindCertificateInStore
CertFreeCertificateChain

Sections

.text
Size: 541KB - Virtual size: 540KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8d42dc75ca400c110899cd420e2415df

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

urlmon

comctl32

kernel32

user32

gdi32

advapi32

shell32

ws2_32

crypt32

Sections

.text Size: 541KB - Virtual size: 540KB

.rdata Size: 130KB - Virtual size: 129KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 541KB - Virtual size: 540KB

.rdata
Size: 130KB - Virtual size: 129KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 22KB