995710596451478545b9113bfd75a219[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
995710596451478545b9113bfd75a219.bin
Size 463KB
Sample240531-dce54acf2s
SHA256 64cee0326d7fd3ee0741a789d2b92d0b35debd83c321855e3dcc7875ed1d1eab
MD5 08cc04229993218ddd5885d5d0290e5b
SHA1 8ea9bb85ca3fa73a6c05fd18836a9c21b46f64d9
SHA512 c9895184257ca951859381b7ba21c229651ac7db9ce47485fff3b9abf77870da4bf202ba30272c1d1e45da9a41949e120eae9a48b09e12f848e625a77c09157e
SSDEEP 12288:6/6LgbkoIjrCLvpPsjfNbzkoaiJXIguQM7geAQ78fV:xIkvr2vpsjVxaiJY5LEey
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/45048877f5a11bf5d867ac5a8ab503356aeeb46e30a7c9e54e1e28004c288a34.exe

File Explorer

995710596451478545b9113bfd75a219.bin

.zip 463KB
45048877f5a11bf5d867ac5a8ab503356aeeb46e30a7c9e54e1e28004c288a34.exe

.exe 1021KB

995710596451478545b9113bfd75a219.bin

SHA256 64cee0326d7fd3ee0741a789d2b92d0b35debd83c321855e3dcc7875ed1d1eab
MD5 08cc04229993218ddd5885d5d0290e5b
SHA1 8ea9bb85ca3fa73a6c05fd18836a9c21b46f64d9
SHA512 c9895184257ca951859381b7ba21c229651ac7db9ce47485fff3b9abf77870da4bf202ba30272c1d1e45da9a41949e120eae9a48b09e12f848e625a77c09157e
SSDEEP 12288:6/6LgbkoIjrCLvpPsjfNbzkoaiJXIguQM7geAQ78fV:xIkvr2vpsjVxaiJY5LEey
MD5 SHA1 SHA512 SSDEEP

Password

infected

45048877f5a11bf5d867ac5a8ab503356aeeb46e30a7c9e54e1e28004c288a34.exe

IMPHASH 20eef06114ebaa471957d6d81d3c58cb
SHA256 45048877f5a11bf5d867ac5a8ab503356aeeb46e30a7c9e54e1e28004c288a34
MD5 995710596451478545b9113bfd75a219
SHA1 44397a09cb8838349bb2eee0b2330ef47874039e
SHA512 257fe369d3bc397c326003813fac107a4adbd615a00c297e120de86aed0d49b05c9af9c0ba3f66c1c38108e47732c80d63e0d96d7c8bc7b2105f5db51d727294
SSDEEP 12288:UiTETjuQkaRUHEMuDZ+Haby+/RjnbpEw1P4YZZEepD/H27+Bl2e5bjYcqn6MgWA0:cjukpdpEaAY3lpD/27Ul2afYc+6Mgg+M
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

309190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\544437\src\3\360skinview_trunk\360SkinView\Release\360SkinView.pdb

psapi

GetModuleFileNameExW

kernel32

GetCurrentThreadId WriteFile SetFilePointer FlushFileBuffers SetEndOfFile OpenMutexW TerminateProcess GetTickCount LocalAlloc CreateProcessW GetModuleHandleA FlushInstructionCache RaiseException GetSystemTimeAsFileTime CreateRemoteThread CopyFileW lstrlenA lstrcmpiA GetTempPathW FreeConsole GlobalFree MulDiv InterlockedIncrement GlobalAlloc GetTempFileNameW GlobalLock GlobalUnlock GetCommandLineW SetErrorMode lstrcmpW SetCurrentDirectoryW CloseHandle FreeLibrary SystemTimeToFileTime GetLocaleInfoW WriteConsoleW FreeResource WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode lstrcmpiW GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle HeapCreate IsValidCodePage GetOEMCP GetACP ExitProcess GetStringTypeW LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitThread lstrcmpA TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapSize HeapReAlloc HeapDestroy GetConsoleOutputCP InterlockedExchange CreateEventW GetVersionExW GetProcAddress HeapFree GetProcessHeap HeapAlloc GetModuleHandleW SizeofResource LockResource LoadResource FindResourceW FindResourceExW WaitForSingleObject WaitForMultipleObjects GetVersion GetLastError LocalFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Sleep InterlockedCompareExchange LoadLibraryW SetEvent InterlockedDecrement OpenProcess GetShortPathNameW GetSystemDirectoryW GetSystemWindowsDirectoryW ReadFile WideCharToMultiByte GetCurrentProcess lstrlenW SetLastError ProcessIdToSessionId LoadLibraryA GetUserDefaultUILanguage LoadLibraryExW MultiByteToWideChar ReleaseMutex CreateMutexW GetCurrentProcessId DeviceIoControl MoveFileExW RemoveDirectoryW GetFileAttributesW GetConsoleCP DeleteFileW GetFileSize GetModuleFileNameW GetPrivateProfileStringW TerminateThread CreateThread ResetEvent GetOverlappedResult ReadDirectoryChangesW CreateFileW

user32

CreateAcceleratorTableW ClientToScreen SetCapture ReleaseCapture FillRect InvalidateRgn DestroyAcceleratorTable EnumChildWindows GetFocus CharNextW GetSysColor GetClassNameW GetDlgItem IsChild EndPaint BeginPaint GetWindowTextW GetWindowTextLengthW PeekMessageW CreateDialogParamW GetClassInfoW RegisterClassW BringWindowToTop SwitchToThisWindow LoadImageW DisableProcessWindowsGhosting SendMessageTimeoutW FindWindowW CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW IsWindowVisible UnregisterClassA GetWindowThreadProcessId GetSystemMetrics LoadStringW PostMessageW IsWindow PostQuitMessage MoveWindow KillTimer DestroyWindow GetWindowPlacement ShowWindow SetTimer RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW EnableWindow GetParent SendMessageW SetWindowPos SetFocus IsWindowEnabled SetRectEmpty RegisterWindowMessageW GetMonitorInfoW AllowSetForegroundWindow GetForegroundWindow AttachThreadInput SetForegroundWindow SetActiveWindow GetKeyboardState keybd_event GetWindowRect GetDesktopWindow MonitorFromRect InvalidateRect UpdateWindow MessageBoxW GetActiveWindow GetClientRect GetDC ReleaseDC IsDialogMessageW IsRectEmpty CopyRect OffsetRect MapWindowPoints MonitorFromWindow GetWindow SetWindowTextW GetMessageW TranslateMessage DispatchMessageW DrawTextW PtInRect GetMessagePos ScreenToClient UpdateLayeredWindow SetCursor GetWindowDC GetClassLongW GetCursorPos RedrawWindow SetClassLongW

gdi32

CreateFontW CreateDIBSection CreateRectRgnIndirect CreateCompatibleDC DeleteDC GetTextExtentPoint32W GetObjectA GetTextMetricsW SelectObject GetObjectW GetDeviceCaps CreateCompatibleBitmap GetPixel GetStockObject SetViewportOrgEx BitBlt DeleteObject CreateSolidBrush

advapi32

RegCreateKeyA GetSidSubAuthority GetTokenInformation RegUnLoadKeyW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegQueryValueExW RegNotifyChangeKeyValue RegDeleteKeyW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW SHParseDisplayName SHBindToParent SHGetDataFromIDListW SHGetFolderPathW ord680 ShellExecuteW

ole32

CoTaskMemRealloc OleInitialize CLSIDFromString CoGetClassObject OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CreateStreamOnHGlobal CLSIDFromProgID CoUninitialize CoCreateInstance CoInitialize CoTaskMemFree

oleaut32

SysAllocString SafeArrayGetVartype SafeArrayCopy VariantCopy SafeArrayGetLBound SafeArrayGetUBound DispCallFunc SafeArrayCreate SafeArrayDestroy SafeArrayLock SafeArrayUnlock SysFreeString OleCreateFontIndirect SysStringLen LoadRegTypeLi LoadTypeLi SysAllocStringLen SafeArrayAccessData SafeArrayUnaccessData VarUI4FromStr VariantClear VariantInit

shlwapi

ColorHLSToRGB ColorRGBToHLS PathCompactPathW PathStripPathW ord437 SHSetValueA SHGetValueA PathRemoveExtensionW StrStrIA SHSetValueW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathRemoveFileSpecW StrStrIW PathFileExistsW PathCombineW StrCmpIW PathFindFileNameW PathFindExtensionW

comctl32

InitCommonControlsEx

gdiplus

GdipDrawImagePointRectI GdipResetWorldTransform GdipTranslateWorldTransform GdipCreateBitmapFromStream GdipSaveImageToFile GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawLine GdipAddPathEllipseI GdipSetInterpolationMode GdipCreateBitmapFromFile GdipRotateWorldTransform GdipPrivateAddMemoryFont GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipDrawImageRectRectI GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateFromHWND GdipDrawString GdipGetFontHeight GdipFillRectangle GdipResetClip GdipSetClipRectI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateFontFromLogfontA GdipSetTextRenderingHint GdipMeasureString GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFont GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipSetLinePresetBlend GdipDrawLineI GdipCreatePen2 GdipDrawRectangleI GdipCreateLineBrushFromRect GdipAddPathRectangleI GdipGetPixelOffsetMode GdipSetPenWidth GdipDrawEllipseI GdipSetPenDashStyle GdipSetPenDashOffset GdipAddPathLineI GdipSetPixelOffsetMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapSetPixel GdipBitmapGetPixel GdipGetImageHeight GdipGetImageWidth GdipDrawPath GdipDeletePen GdipCreatePen1 GdipFillPath GdipCreateSolidFill GdipSetSmoothingMode GdipGetSmoothingMode GdipDeletePath GdipCreatePath GdipFillRectangleI GdipCloneBrush GdipAlloc GdipFree GdipDeleteBrush GdipCreateLineBrushFromRectI GdipDeleteGraphics GdipCreateFromHDC GdipClosePathFigure GdipAddPathArcI GdipResetPath GdipCreateFontFromDC

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW InternetSetOptionW InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetOpenW

userenv

GetUserProfileDirectoryW

msvfw32

MCIWndCreateW

imm32

ImmDisableIME

setupapi

SetupIterateCabinetW