0049147ea9abb61beeae3f5cc878917bf5c81effc49dc8b7bc735dfa6962e74b.bin.bin
- SHA256 0049147ea9abb61beeae3f5cc878917bf5c81effc49dc8b7bc735dfa6962e74b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe
Resource
win7-20240221-en
windows7-x64
22 signatures
150 seconds
General
- Target 0049147ea9abb61beeae3f5cc878917bf5c81effc49dc8b7bc735dfa6962e74b.bin.bin
- Size 38KB
- Sample240518-lt5fbaea6s
- SHA256 0049147ea9abb61beeae3f5cc878917bf5c81effc49dc8b7bc735dfa6962e74b
- MD5 c6830ee407c432e371d7739589b3e5e2
- SHA1 b63c5a1924a82a3c50c8ec4200ece8de881913e1
- SHA512 b293278bbd7e6adef00012a5c8ebd2113952b1763ce834bef1c07421f303f52c9f0649a4316b90e99c474a006522ce81907eee19caf61bcb2ef951d5943701a6
- SSDEEP 768:C5rbpuQ5C8dkDMy/l/yVeWq+q5nAcYRDoZsbcnAlLy2C:C5HpuQ5C8dO3/tdWqsp4sQnAVy2C
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe
File Explorer
-
0049147ea9abb61beeae3f5cc878917bf5c81effc49dc8b7bc735dfa6962e74b.bin.bin.zip 38KB
-
66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe.exe 104KB
66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe
- IMPHASH d525aa9cd7c3f294b7bc9fa25b9dd6f5
- SHA256 66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54
- MD5 9a24a00438a4d06d64fe4820061a1b45
- SHA1 6e59989652dff276a6dfa0f287b6c468a2f04842
- SHA512 80e97c8c389554ba0512b7f496dd03e82f2a627568eca631a6393033d540a70779fc7eae2485d1b9ca3657beb8ae9a86fd08ecd5dba678407bf8e63bef9a4629
- SSDEEP 1536:KlULHCIFmav82fkJMTZ0imzS6ussgExLXCxnbKG:wUDeO9TZH6SngYsbKG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
30880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
gethostname
recvfrom
setsockopt
closesocket
htons
shutdown
WSAStartup
connect
WSAWaitForMultipleEvents
listen
WSASocketA
WSACreateEvent
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSASend
WSARecv
WSACloseEvent
accept
getpeername
getsockname
inet_addr
gethostbyname
inet_ntoa
socket
bind
sendto
ioctlsocket
recv
send
shlwapi
StrStrIA
StrCmpNW
StrStrW
PathFileExistsW
StrChrA
PathFindFileNameW
StrCmpNIA
PathMatchSpecW
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
InternetOpenW
DeleteUrlCacheEntry
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCrackUrlA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetOpenUrlA
ntdll
strlen
isdigit
isalpha
memcpy
memset
NtQueryVirtualMemory
RtlUnwind
_chkstk
_aulldiv
wcslen
wcscmp
_allshl
_aullshr
strstr
strcmp
memmove
memcmp
RtlTimeToSecondsSince1980
NtQuerySystemTime
mbstowcs
msvcrt
_vscprintf
srand
rand
kernel32
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
FindNextFileW
SetEvent
CreateProcessW
GetLocaleInfoA
DeleteCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
InterlockedExchangeAdd
InterlockedIncrement
WaitForSingleObject
InterlockedDecrement
InterlockedExchange
HeapFree
HeapValidate
HeapReAlloc
GetProcessHeaps
HeapCreate
HeapSetInformation
GetCurrentProcessId
HeapAlloc
CreateMutexA
GetLastError
ExitProcess
CreateEventA
CreateThread
GetModuleFileNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetFileAttributesW
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
lstrcmpW
MoveFileExW
CreateIoCompletionPort
FindClose
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
ExpandEnvironmentStringsW
DeleteFileW
WriteFile
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
MapViewOfFile
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
lstrlenW
lstrcpynW
MultiByteToWideChar
ExitThread
GetTickCount
Sleep
GetModuleHandleW
CloseHandle
UnmapViewOfFile
GetFileSize
user32
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
wsprintfW
DefWindowProcA
ChangeClipboardChain
RegisterRawInputDevices
GetClipboardData
DispatchMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
SendMessageA
SetWindowLongW
SetClipboardViewer
GetWindowLongW
wsprintfA
wvsprintfA
OpenClipboard
advapi32
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegSetValueExW
RegSetValueExA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=138, version=30729,
count=2, id=257, version=29304,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=192, id=1, productName=Unmarked objects,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,