e27c6586dba78d5d302589f3b231be40[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

e27c6586dba78d5d302589f3b231be40.bin
Size

246KB
MD5

a7e7d7c7bb962121ea66dd3ac107095e
SHA1

761db2893f789aef052d77a5e916d59495f2470b
SHA256

326bb0588691de03471c53814ec4ca4260b4366de05332a0973564889735960a
SHA512

fa56c51dfc41240d54fa9ac84896b58f19f3f2936ebae122edfedbb210d6a67c2c10b8af4a9972ba21c79b239781004dda5a4e6f883ceb8ff953103c3374a8f3
SSDEEP

6144:WR381G2mPOEMIFD740sKnhDxyi9SBCKeZaiJglCzM2Q:WRM1Wpx74inpIi9WDeZaiDa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.exe

Files

e27c6586dba78d5d302589f3b231be40.bin
.zip

Password: infected
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.exe
.dll windows:6 windows x64 arch:x64

Password: infected

b3fa4aa3c7d2c22e73d7a820bc5c7b27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Bamboo\home\xml-data\build-dir\OEMSDK-UNINSTALL-SOURCES\bin\x64\Release\OEMUninstall.pdb

Imports

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString

oleaut32

SysFreeString
SysAllocString
VariantClear

crypt32

CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose

wintrust

WinVerifyTrust

Exports

Exports

oemuninstall_init
vgml

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b3fa4aa3c7d2c22e73d7a820bc5c7b27

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ole32

oleaut32

crypt32

wintrust

Exports

Exports

Sections

.text Size: 283KB - Virtual size: 282KB

.rdata Size: 102KB - Virtual size: 101KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 14KB - Virtual size: 13KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 60KB - Virtual size: 60KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 283KB - Virtual size: 282KB

.rdata
Size: 102KB - Virtual size: 101KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 14KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 60KB - Virtual size: 60KB

.reloc
Size: 3KB - Virtual size: 2KB