d1ef0f926c622e2302786246cc70bfdb[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
d1ef0f926c622e2302786246cc70bfdb.bin
Size 991KB
Sample240319-ebk6dsge96
SHA256 b8c8e5de1bb47e9874b6cba5723642b65f1f36cbf21b51c9d266e5a786e58c5f
MD5 d1ef0f926c622e2302786246cc70bfdb
SHA1 3db925e4cf140663f423150a62457e91290fece2
SHA512 3035bb19e36a9d1df0db3deeb07e9b4c8a8de504d2651c0f55e44f20dc7b31235c2d29d6a302dbb1a64044063cb72deb85044a2936c1728c261b66bd486aaa4f
SSDEEP 24576:PL5/rmRsmDWDPNuFhPvYrpLYHSfcoopooLY9Nu0/c4/RT:lK5hPILYHSfeY9n/D/d
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1ef0f926c622e2302786246cc70bfdb.bin

File Explorer

d1ef0f926c622e2302786246cc70bfdb.bin

.dll 991KB

d1ef0f926c622e2302786246cc70bfdb.bin

IMPHASH d7a22f39ec68f55e9cbc964000ed658c
SHA256 b8c8e5de1bb47e9874b6cba5723642b65f1f36cbf21b51c9d266e5a786e58c5f
MD5 d1ef0f926c622e2302786246cc70bfdb
SHA1 3db925e4cf140663f423150a62457e91290fece2
SHA512 3035bb19e36a9d1df0db3deeb07e9b4c8a8de504d2651c0f55e44f20dc7b31235c2d29d6a302dbb1a64044063cb72deb85044a2936c1728c261b66bd486aaa4f
SSDEEP 24576:PL5/rmRsmDWDPNuFhPvYrpLYHSfcoopooLY9Nu0/c4/RT:lK5hPILYHSfeY9n/D/d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

798720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

g:\Acro_root_ns\bravo\public\libraries\windows\release\dynamic\ace2mtdll\ACE.pdb

kernel32

SystemTimeToFileTime GetSystemTime GetProfileStringA LoadLibraryA FreeLibrary GlobalMemoryStatus GetSystemDirectoryA MultiByteToWideChar GetFileAttributesA CreateDirectoryA FileTimeToSystemTime FindNextFileA GetLastError GetACP FindFirstFileA Sleep SetProcessAffinityMask GetProcessAffinityMask GetCurrentProcess CreateThread CreateEventA CloseHandle SetEvent WaitForSingleObject WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId GetTickCount FindClose GetModuleFileNameA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleA GetProcAddress GetSystemInfo GetVersionExA IsValidCodePage IsProcessorFeaturePresent QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedCompareExchange InterlockedExchange GetSystemTimeAsFileTime

user32

wsprintfA LoadStringA

gdi32

GetICMProfileA CreateDCW GetICMProfileW DeleteDC CreateDCA

advapi32

RegOpenKeyExA RegQueryInfoKeyA RegEnumValueA RegCloseKey RegQueryValueExA

shell32

SHGetFolderPathA

ole32

CoCreateInstance

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

??1exception@std@@UAE@XZ ??3@YAXPAX@Z ??0exception@std@@QAE@XZ _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ?what@exception@std@@UBEPBDXZ strcmp strlen malloc free _purecall _gmtime64 _time64 strncmp sprintf strcpy pow fabs strcat strncpy ??0exception@std@@QAE@ABQBD@Z ??_V@YAXPAX@Z _invalid_parameter_noinfo ??2@YAPAXI@Z strrchr wcsstr tolower wcstok_s bsearch qsort ??0exception@std@@QAE@ABQBDH@Z fopen fclose ftell fseek fread fwrite remove rename _strupr sqrt strncat memcmp log10 _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook _except_handler4_common ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal memset log memcpy __CxxFrameHandler3

Name

.text

Size

528KB

Virtual Size

527KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d1ef0f926c622e2302786246cc70bfdb.bin

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp80

msvcr80

generic