50dcf187ffcaa37865750210fc3ed118[.]bin

General

Target

50dcf187ffcaa37865750210fc3ed118.bin
Size

23.0MB
MD5

707af07f9bc8260d9fe5e53b4894c349
SHA1

68cc885176212dcd5ad155927b09692a9015ba39
SHA256

0ff1ca150d1fb7388d6f006e23b0ff0b4a23477b92541a9596081a07a06ace7f
SHA512

c6d7ec8181ac52ffd71f6c5dbacd6544d45927b6c7a45534e8cc0d86019f4201e01a91952406deb9d083c91bb2bd89fd68a9026ff36141c01a642dbe945da0c4
SSDEEP

393216:Z+opjj1o8xK/33WF3788OgEkshnVjT8qYSITItOoNvv3q2UlKoep5cRG+8N:IQ/i8M/3S378mYVjYq/IyOoxCUcRG+Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/be220ce0e76d629eacd923c9f034387fe5962889d67ad3b358fa057fcd5e6df0.exe

Files

50dcf187ffcaa37865750210fc3ed118.bin
.zip

Password: infected
be220ce0e76d629eacd923c9f034387fe5962889d67ad3b358fa057fcd5e6df0.exe
.exe windows:4 windows x86 arch:x86

Password: infected

3dbb35930afd16d5a0423571da5ea031

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
lstrlenA
_lopen
GetCommandLineA
GetModuleHandleA
GetModuleFileNameA
_lwrite
_llseek
GlobalUnlock
lstrcpyA
MulDiv
_lclose
GlobalAlloc
GlobalFree
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
GetTempPathA
GetTempFileNameA
GlobalLock

user32

GetDC
PostQuitMessage
InvalidateRect
BeginPaint
EndPaint
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
ReleaseDC
SetWindowPos
ShowWindow
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
ExitWindowsEx
SetTimer
UpdateWindow

gdi32

DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
GetTextExtentPointA
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
SelectPalette
CreatePalette
CreateFontA
RealizePalette

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

_MainWndProc@16
_StubFileWrite@12

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

3dbb35930afd16d5a0423571da5ea031

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 996B

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 996B

.rsrc
Size: 2KB - Virtual size: 1KB