6556b3ca424db754337ab375e343eb97[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

6556b3ca424db754337ab375e343eb97.bin
Size

14.4MB
MD5

905b69711b3d61ae08c4e52b20b84abb
SHA1

70a58cbfcec3c3f48617ebc8c2f9e485fead1e46
SHA256

09a5205c21e7228040dff2d344abc5b728e07ef0f88337ec6d1bc4baf1531f48
SHA512

6e60c420e9f21aa05814b59dd153b6a4236354f81e38e1d19d549ea418a4d2a8fdaa2e738766d876cae56ec2362a320e0784618c851a8f390fab39737726ba12
SSDEEP

196608:tWJDX8vefhlj7zy4x7Xa8PZadBsrjKH7wRIVPoOAtClVMmVBA+fKbT+F/bHBXIiX:PchV7bwwRyoOAYl7q+fmT+JB4u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/52231c311a10ab3adf5fdf74f8215d24c7a33356d88d442b0ebf638b6a7d8f32.exe

Files

6556b3ca424db754337ab375e343eb97.bin
.zip

Password: infected
52231c311a10ab3adf5fdf74f8215d24c7a33356d88d442b0ebf638b6a7d8f32.exe
.exe windows:5 windows x86 arch:x86

Password: infected

770900936ce89a4cd8279c4d045993fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\delivery\Dev\wix37_public\build\ship\x86\setup.pdb

Imports

comctl32

ord17

msi

ord190
ord70
ord141
ord169
ord88
ord175

user32

SetDlgItemTextW
EnableWindow
MessageBoxW
IsDlgButtonChecked
GetDlgItem
LoadStringW
MessageBoxExW
DialogBoxParamW
EndDialog
SetDlgItemTextA
SetWindowTextW

shell32

CommandLineToArgvW
SHGetFolderPathW

ole32

StringFromGUID2

kernel32

SetStdHandle
RtlUnwind
WriteConsoleW
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
GetLastError
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetTempPathW
DeleteFileW
CompareStringW
GetCommandLineW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
LockResource
SizeofResource
LoadResource
FindResourceExA
CloseHandle
WriteFile
CreateFileW
GetFileAttributesW
CreateDirectoryW
MoveFileExW
GetTempFileNameW
GetCurrentProcessId
GetModuleFileNameA
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
Sleep
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
GetModuleFileNameW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
FlushFileBuffers

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15.0MB - Virtual size: 15.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

770900936ce89a4cd8279c4d045993fd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

msi

user32

shell32

ole32

kernel32

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 15.0MB - Virtual size: 15.0MB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 15.0MB - Virtual size: 15.0MB

.reloc
Size: 4KB - Virtual size: 4KB