cb592f2f6fa4c21fc856975c02b08f1c27c79fbaf272094be141161736ef9ce4

Sharing

Copy URL

Twitter E-mail

General

Target

cb592f2f6fa4c21fc856975c02b08f1c27c79fbaf272094be141161736ef9ce4
Size

268KB
MD5

3e79624ddd9660822ace2b563a5804db
SHA1

6369460184ab9824ac7c85bdcbfe9ab67e43ef6c
SHA256

cb592f2f6fa4c21fc856975c02b08f1c27c79fbaf272094be141161736ef9ce4
SHA512

3fce193c9093281b0fecff46ca872e31af9eab76ec1978291cbe32ae88f9b03e3ecbc1dd364131d08e71385eaa551049b28d1c1747c1e9472a21c2a5a35a6242
SSDEEP

6144:B1zczG0AECbGw4ER5qcmVWrXTXY+uxePz2ICor/Ewa:B1Qz8KxERscmVW7TXY+uxeb2ICND

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/558.bin

Files

cb592f2f6fa4c21fc856975c02b08f1c27c79fbaf272094be141161736ef9ce4
.zip

Password: infected
558.bin
.exe windows:6 windows x86 arch:x86

ed5b59db4ea8659a6ddc7d45f89d57f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Time\Would\dictionary\Visit\like\Sent\whichheat.pdb

Imports

kernel32

LoadLibraryExW
HeapReAlloc
SetFilePointerEx
OutputDebugStringW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
CloseHandle
GetOEMCP
SetStdHandle
WriteConsoleW
ReadConsoleW
CreateFileW
GetVersion
ReadFile
TlsAlloc
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetTimeZoneInformation
GetCurrentThreadId
HeapSize
GetModuleFileNameW
WriteFile
GetStdHandle
GetModuleHandleA
ExitProcess
GetProcessHeap
IsDebuggerPresent
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
RtlUnwind
RaiseException
GetCPInfo
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetStringTypeW
MultiByteToWideChar
GetSystemTimeAsFileTime
SetEnvironmentVariableA
WideCharToMultiByte
FindClose
RemoveDirectoryA
GetEnvironmentVariableA
GetProcAddress
GetSystemDirectoryA
FileTimeToSystemTime
CreateEventA
Sleep
GetVolumeInformationA
GetModuleHandleExW
TlsGetValue

user32

CheckRadioButton
SetWindowPos
GetAsyncKeyState
GetWindowTextA
GetMessagePos
FindWindowA
SetClipboardData
UpdateWindow
GetDC
SendMessageA
SetForegroundWindow
SendDlgItemMessageA
GetClassNameA
DestroyWindow
EnumChildWindows

gdi32

SelectClipRgn
CreateCompatibleDC
CreateRectRgn
Escape
GetPixel
TextOutA
CreateFontA

winspool.drv

SetFormA
EndDocPrinter
AddPrintProvidorA
AddPrintProcessorA
DeletePrinterDriverA
AddPortA
DeletePortA
SetPrinterDataA
EnumMonitorsA
DeleteFormA
SetPortA
SetPrinterDataExA
AddMonitorA
ScheduleJob
AddPrinterConnectionA
ReadPrinter
EnumPortsA
EnumPrintProcessorsA
AddPrinterDriverA
GetPrinterDataA
ResetPrinterA
PrinterMessageBoxA
EnumPrintProcessorDatatypesA
XcvDataW
GetPrinterDriverDirectoryA
OpenPrinterA
DeletePrinterKeyA
ConfigurePortA
GetPrinterDataExA
GetJobA
AddPrinterDriverExA
ClosePrinter
DeletePrinterDataExA
DeletePrinterConnectionA
EnumPrinterKeyA
EnumPrinterDriversA
DeletePrintProvidorA
StartPagePrinter
AbortPrinter
GetPrintProcessorDirectoryA
StartDocPrinterA
EnumFormsA
EndPagePrinter
GetPrinterA
AddPrinterA
DeletePrinter
WaitForPrinterChange
DeleteMonitorA
GetPrinterDriverA
AddFormA
EnumJobsA
GetFormA
DeletePrinterDataA
EnumPrinterDataExA
AddJobA
FlushPrinter
DeletePrinterDriverExA
EnumPrinterDataA
EnumPrintersA
SetJobA
FindClosePrinterChangeNotification
DeletePrintProcessorA
WritePrinter

comctl32

InitCommonControlsEx
ImageList_SetBkColor
ImageList_AddMasked
ImageList_SetIconSize
ImageList_Destroy
ImageList_Remove

comdlg32

GetSaveFileNameA
GetOpenFileNameA
ChooseColorA

ole32

OleInitialize
OleSetContainedObject
OleUninitialize

Sections

.text
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ed5b59db4ea8659a6ddc7d45f89d57f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

comctl32

comdlg32

ole32

Sections

.text Size: 182KB - Virtual size: 182KB

.rdata Size: 103KB - Virtual size: 102KB

.data Size: 7KB - Virtual size: 65KB

.rsrc Size: 350KB - Virtual size: 349KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 182KB - Virtual size: 182KB

.rdata
Size: 103KB - Virtual size: 102KB

.data
Size: 7KB - Virtual size: 65KB

.rsrc
Size: 350KB - Virtual size: 349KB

.reloc
Size: 8KB - Virtual size: 7KB