4f8fb134c680d0e05861a34827751834[.]bin

General

Target
4f8fb134c680d0e05861a34827751834.bin
Size 667KB
Sample240426-bl8snagg4v
SHA256 9bfe431e64c8035762e47d1aa8aa100bb6fb5e5a6834495d94bb287f3bcbd8d7
MD5 38a2a60f3febd025b8553007e943480d
SHA1 df35f09a295b2e03282bf3bb39104f372eda0499
SHA512 deb3af66abd9c5a65a3b8150ba9e805975ce4c98d2eaac4cb228ba46d0044de9193b4bc31c40f5b308528c54b8d01e7c8333573f0d0f3c9185f5ee37ed921aaf
SSDEEP 12288:J7B83aKNAuf8OBOLXqQmx+EXiavh1qUAWLrKQ9BDHKektRqUBd7hq:J7eaGQLuxTyap10oGQ9hK1qU5q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0.exe

File Explorer

4f8fb134c680d0e05861a34827751834.bin

.zip 667KB
9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0.exe

.exe 763KB

4f8fb134c680d0e05861a34827751834.bin

SHA256 9bfe431e64c8035762e47d1aa8aa100bb6fb5e5a6834495d94bb287f3bcbd8d7
MD5 38a2a60f3febd025b8553007e943480d
SHA1 df35f09a295b2e03282bf3bb39104f372eda0499
SHA512 deb3af66abd9c5a65a3b8150ba9e805975ce4c98d2eaac4cb228ba46d0044de9193b4bc31c40f5b308528c54b8d01e7c8333573f0d0f3c9185f5ee37ed921aaf
SSDEEP 12288:J7B83aKNAuf8OBOLXqQmx+EXiavh1qUAWLrKQ9BDHKektRqUBd7hq:J7eaGQLuxTyap10oGQ9hK1qU5q
MD5 SHA1 SHA512 SSDEEP

Password

infected

9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0.exe

IMPHASH da85065239035ee146657c2492fb98d0
SHA256 9c9ed624eaf441b4637d50fe25d386636c5cb59fb69f5b824afc7cec6dfff7f0
MD5 4f8fb134c680d0e05861a34827751834
SHA1 5a20d1ff30218dea67d3ff7f61e16e5cc958006f
SHA512 ba90af804408ffde34cb5b7d8d4a4b30ea99f66844ee3d272368086a3bae472347c76440fe93196a457e4fbc10a67b6312a998fd8d30a06001c4b635838fee35
SSDEEP 12288:S13ahbKvq4YIvjnARDUsrD4Shv9QSrwZ/BpOtI7wWsvvaGDXRorYm+0FPSoyWHJk:NJ49sHv9zsZ/B0tWFoXRorg0BSFWHJPc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

17215

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tofagehu\hiv.pdb

kernel32

LocalCompact GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW GetLocaleInfoW ReadConsoleInputA WriteConsoleW GetModuleFileNameW MultiByteToWideChar GetTempPathW InterlockedExchange GetLastError FindResourceExW SetLastError GetThreadLocale GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetOEMCP GlobalUnWire LoadLibraryExA SetCalendarInfoA GetConsoleProcessList GetVolumeInformationW ChangeTimerQueueTimer GetSystemDefaultLangID GetStringTypeW HeapAlloc EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetProcessHeap EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetFileType GetStartupInfoW CloseHandle GetCurrentThreadId GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo OutputDebugStringW SetStdHandle SetFilePointerEx HeapReAlloc LCMapStringW CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Sharing