ea65b206ae11f120d7d93e22884c37d9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

ea65b206ae11f120d7d93e22884c37d9.bin
Size

142KB
MD5

c09b940b2b3e93ecb5a04b12feddb498
SHA1

7185c6ec314e1dc49f464e91ebe3edec46cea234
SHA256

c2dc745305a40d05b58c14e9af1c7be8f76d34af3d1a8edcdb97e9a3f8086ab4
SHA512

b7f20428ed06bb6cd600855ee9c98f017142971b019a762da4b2fc596067312152f51025ea73cea92627abe58fe03dd78b3f500aa134754a8c201c9bda7345ec
SSDEEP

3072:q+Z7WqIW7+N80SlveLZI8in4ALZcI8EH80LMi1RSq:0VWs8JmKn4wD8e8qT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f.exe

Files

ea65b206ae11f120d7d93e22884c37d9.bin
.zip

Password: infected
6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f.exe
.exe windows:6 windows x64 arch:x64

Password: infected

a9396cdd58d948dc97c40bddc29b7794

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

justice.pdb

Imports

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlCaptureContext
RtlPcToFileHeader
NtCreateSymbolicLinkObject
RtlLookupFunctionEntry
NtDeleteKey

rpcrt4

RpcMgmtEpEltInqDone
RpcBindingToStringBindingW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcMgmtEpEltInqNextW
RpcBindingFree
NdrClientCall3
RpcMgmtEpEltInqBegin

kernel32

GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetCommandLineW
SetErrorMode
LocalFree
GetCurrentProcessId
GetModuleHandleW
OutputDebugStringW
CreateDirectoryW
ReadFile
SizeofResource
FindFirstFileW
GetFileSizeEx
SearchPathW
FindNextFileW
WriteFile
RemoveDirectoryW
FindClose
WaitForSingleObject
FlushFileBuffers
GetFileAttributesW
ReleaseMutex
UnmapViewOfFile
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LockResource
DeleteFileW
CloseHandle
LoadResource
FindResourceW
GetWindowsDirectoryW
SetFilePointerEx
CreateMutexExW
GetComputerNameW
CreateFileMappingW
MapViewOfFile
GetSystemWindowsDirectoryW
GetFileTime
HeapFree
HeapAlloc
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
WriteConsoleW
HeapSize
CreateFileW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
CompareStringW
LCMapStringW

user32

wsprintfW

advapi32

RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
GetUserNameW
RegCloseKey

shell32

SHFileOperationW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a9396cdd58d948dc97c40bddc29b7794

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

rpcrt4

kernel32

user32

advapi32

shell32

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 3KB - Virtual size: 3KB