9a6f05ab019e9c9189b5599623ddd33e[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

9a6f05ab019e9c9189b5599623ddd33e.bin
Size

469KB
MD5

5ecf1b979ec5062152ccd8d5e4de25f5
SHA1

0456e1f652f0a044d486d4b81962d3911e2f48f0
SHA256

6115b1e0d25148834e7b369889fe88be3901953fc64c5a5dc7599845e0e860f2
SHA512

0abda094ea89af71060593977a7d7a3dcb80e8b8bb0361694b991a62b5909b5f1af90f0e49bbc0f5d4ca56e35328c15f90fc3fe9df32e630f780e734b89286d2
SSDEEP

12288:2W8ByS6tuCYnpQqjgQQADrWFNOaGMsGw3v7Nz34:2W8ByS64GqjtGFFGhH3jNk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f3ad57044ff8be6139df87cd5454379c63f5bc3a3120c774ae71fb4c6cd58f50.exe

Files

9a6f05ab019e9c9189b5599623ddd33e.bin
.zip

Password: infected
f3ad57044ff8be6139df87cd5454379c63f5bc3a3120c774ae71fb4c6cd58f50.exe
.exe windows:5 windows x86 arch:x86

Password: infected

3f5b1257870d4f7d46c486840f6d932c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\jenkins-workspace\workspace\client-builder-product\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

Imports

kernel32

CloseHandle
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
CreateFileA
SetFilePointer
SetUnhandledExceptionFilter
ReadFile
CreateFileW
VirtualAlloc
GetModuleFileNameA
GetCurrentProcessId
DebugBreak
ExitProcess
VerSetConditionMask
CreateDirectoryW
WaitForSingleObject
SetEvent
GetModuleHandleW
GlobalAlloc
LoadLibraryW
TerminateThread
Sleep
TerminateProcess
VerifyVersionInfoW
CreateEventW
GetVersionExA
CreateThread
GetLocaleInfoW
ConnectNamedPipe
CreateNamedPipeW
WriteFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
GetFileSizeEx
SetLastError
GetCommandLineW
WriteConsoleW
SetStdHandle
OutputDebugStringW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetStdHandle
GetProcessHeap
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetModuleHandleExW
EnumSystemLocalesW
GetCurrentThreadId
GetModuleHandleA
ReadProcessMemory
GetTickCount
GetLastError
GetModuleFileNameW
GetDriveTypeW
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetVolumeInformationA
LocalFree
GetUserDefaultLCID
IsValidLocale
LCMapStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
LoadLibraryExW
FreeLibrary
GetCPInfo
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
IsProcessorFeaturePresent
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
EncodePointer
DecodePointer

user32

SetWindowPos
LoadCursorA
DefWindowProcW
MoveWindow
DispatchMessageW
ShowWindow
CreateWindowExW
EndPaint
DestroyWindow
GetMessageW
PostQuitMessage
PostMessageW
GetKeyState
FindWindowW
GetClientRect
BeginPaint
TranslateMessage
RegisterClassExW
InvalidateRect
GetWindowLongW
SetWindowLongW

shell32

SHGetSpecialFolderPathW
DragQueryFileW
DragFinish
CommandLineToArgvW

ole32

StgCreateStorageEx
CreateStreamOnHGlobal
OleSetContainedObject
OleInitialize
OleUninitialize
ReleaseStgMedium
OleCreate
CoTaskMemFree

oleaut32

VariantClear
SysStringLen
VariantInit
SysFreeString
DispGetParam
SysAllocString

shlwapi

PathFindExtensionW
PathCombineW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW

Sections

.text
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

3f5b1257870d4f7d46c486840f6d932c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 250KB - Virtual size: 250KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 10KB - Virtual size: 28KB

.rsrc Size: 1024B - Virtual size: 784B

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 250KB - Virtual size: 250KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 10KB - Virtual size: 28KB

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 14KB - Virtual size: 13KB