03cea6f6022a3a08d1ea003091a3e502[.]bin

General

Target
03cea6f6022a3a08d1ea003091a3e502.bin
Size 666KB
Sample240426-bcy7vsgf57
SHA256 01eb4565a8e660b3358e83aceecf578c24426654861b2c7bf6a2d5348cb55839
MD5 159ee53f580a2a77228678a6297d315e
SHA1 8d38da2301259fca81e790164c04d3892372b9d2
SHA512 4c6b2594aca98d111c89622fa33063eb6e19dbeebf7c2cb36393620e1a8b415a0fc8260268eefbef3beef9a77496337840b66cbac1ea20902ff0feb88c9275fc
SSDEEP 12288:EbOHw16pYicvjZs79kSJItIt+4t5LIi1crgg/JtKSyrlh2an3icj:EbOHw19s76/4IobGtKNjj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

File Explorer

03cea6f6022a3a08d1ea003091a3e502.bin

.zip 666KB
2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

.exe 762KB

03cea6f6022a3a08d1ea003091a3e502.bin

SHA256 01eb4565a8e660b3358e83aceecf578c24426654861b2c7bf6a2d5348cb55839
MD5 159ee53f580a2a77228678a6297d315e
SHA1 8d38da2301259fca81e790164c04d3892372b9d2
SHA512 4c6b2594aca98d111c89622fa33063eb6e19dbeebf7c2cb36393620e1a8b415a0fc8260268eefbef3beef9a77496337840b66cbac1ea20902ff0feb88c9275fc
SSDEEP 12288:EbOHw16pYicvjZs79kSJItIt+4t5LIi1crgg/JtKSyrlh2an3icj:EbOHw19s76/4IobGtKNjj
MD5 SHA1 SHA512 SSDEEP

Password

infected

2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

IMPHASH 0c221599ea7b9c4f042cfb23a69ed3b1
SHA256 2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2
MD5 03cea6f6022a3a08d1ea003091a3e502
SHA1 643e34573258d1511921c8d97a5b3c26d6c70b62
SHA512 560ec4d84a74b9089d12a6e00b02acb8fa1364f75172a2fd0916c030350ff9fe32ea137a3fdd8df3648870c82935131fdee9de6d00066d97f9d073cf85648e42
SSDEEP 12288:e2ZPFVL/YNfMNwpo4id34UcFg522Af3mhQIDBYHJD9wICzXXRXGoKU:e2tcMNqo3/c+52TvsQ0CjCdKU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

16207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xinasu.pdb

kernel32

LocalCompact GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW GetLocaleInfoW ReadConsoleInputA WriteConsoleW MultiByteToWideChar GetTempPathW InterlockedExchange GetLastError ChangeTimerQueueTimer SetLastError FindResourceExW GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA SetCalendarInfoA GetWindowsDirectoryW GetConsoleProcessList GetVolumeInformationW GetThreadLocale GetSystemDefaultLangID GetStringTypeW OutputDebugStringW EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree HeapAlloc ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle GetCurrentThreadId GetProcessHeap WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle FlushFileBuffers CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Sharing