63e8483b57ff55e73d7c2c3432bb7f7c[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
63e8483b57ff55e73d7c2c3432bb7f7c.bin
Size 7.9MB
Sample240602-bhg6jaeb35
SHA256 b07b0d5f18622f1892406e84e739e385fa9077592134729637c4b6966c64c1f3
MD5 63e8483b57ff55e73d7c2c3432bb7f7c
SHA1 4a3fa272dab1e89642b3529c5dd5e3457ea03b49
SHA512 d75298c3d280ed865a66294f7e87e4ba3cc71e807cd5c2dd1fe535c260259ac5abae89da43998389e2509d080ab3ca448d54a22fa9a6b63d6fcc7e8b2c84db59
SSDEEP 98304:Dz16s9EwkidrwQwPdz9u/ZZmDZJErUXQbZT7wIX02kVmH4:Dz16gBrd3gu/XmDZiU0txrH4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63e8483b57ff55e73d7c2c3432bb7f7c.bin

File Explorer

63e8483b57ff55e73d7c2c3432bb7f7c.bin

.exe 7.9MB

63e8483b57ff55e73d7c2c3432bb7f7c.bin

IMPHASH 26d1142062053486e607ffede8dd675c
SHA256 b07b0d5f18622f1892406e84e739e385fa9077592134729637c4b6966c64c1f3
MD5 63e8483b57ff55e73d7c2c3432bb7f7c
SHA1 4a3fa272dab1e89642b3529c5dd5e3457ea03b49
SHA512 d75298c3d280ed865a66294f7e87e4ba3cc71e807cd5c2dd1fe535c260259ac5abae89da43998389e2509d080ab3ca448d54a22fa9a6b63d6fcc7e8b2c84db59
SSDEEP 98304:Dz16s9EwkidrwQwPdz9u/ZZmDZJErUXQbZT7wIX02kVmH4:Dz16gBrd3gu/XmDZiU0txrH4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2954362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Set-up.pdb

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW PathIsRelativeW PathRemoveBackslashW PathIsNetworkPathW PathStripPathW UrlIsW SHGetValueW UrlEscapeW PathFindFileNameW PathRemoveFileSpecW PathRemoveExtensionW PathFileExistsW PathAddExtensionW PathIsFileSpecW PathAppendW PathIsDirectoryW PathRenameExtensionW PathIsSystemFolderW PathFileExistsA PathAddBackslashW PathIsRootW PathStripToRootW

shell32

SHCreateDirectoryExW ord51 SHGetKnownFolderPath ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation SHBrowseForFolderW ord680 SHGetMalloc SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW

kernel32

FindNextFileW WaitForMultipleObjects CreateFileW CreateEventW SetEvent ResetEvent GetOverlappedResult ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte GetFileSizeEx FindClose GetFileAttributesW SetFileAttributesW DeleteFileW GetLocalTime GetTimeFormatW GetDateFormatW GetCurrentProcess DeviceIoControl GetTempPathW GetVersionExW GetComputerNameExW FileTimeToSystemTime GetNativeSystemInfo RaiseException LoadLibraryW GetProcAddress CreateProcessW GetModuleHandleW FreeLibrary InitializeCriticalSectionEx DecodePointer MulDiv GetModuleFileNameW TerminateProcess RemoveDirectoryW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CopyFileW GetExitCodeProcess ReadFile SetLastError lstrlenW LocalAlloc GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW GetFileSize lstrcpyW lstrcmpiW lstrcmpW GetDriveTypeW GetFullPathNameW HeapSize HeapReAlloc HeapDestroy GlobalAlloc GlobalLock GlobalUnlock GetSystemDirectoryW SetDllDirectoryW GetStdHandle AttachConsole FreeConsole GetConsoleWindow AreFileApisANSI TryEnterCriticalSection HeapCreate WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer LeaveCriticalSection SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW GlobalFree VerSetConditionMask FindFirstFileW GetUserDefaultLCID LCMapStringW DuplicateHandle ProcessIdToSessionId TerminateThread CreateThread FindResourceExW GetThreadTimes QueryFullProcessImageNameW GetUserDefaultLangID GetUserDefaultUILanguage SetNamedPipeHandleState CreateNamedPipeW ConnectNamedPipe CreateDirectoryW ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW GetTimeZoneInformation VirtualFree VirtualAlloc QueryPerformanceFrequency GetCurrentThread SetFilePointerEx ResumeThread SetThreadPriority EnterCriticalSection CompareStringW GetCPInfo EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStringTypeW GetExitCodeThread SwitchToThread GetModuleHandleExW QueueUserWorkItem IsProcessorFeaturePresent LoadLibraryExA VirtualQuery VirtualProtect GetCurrentProcessId GetCurrentThreadId OpenMutexW CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetProcessHeap HeapAlloc HeapFree LocalFree GetLastError FormatMessageW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask DeleteCriticalSection RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle WriteConsoleW ExitProcess GetConsoleCP GetConsoleMode IsValidLocale EnumSystemLocalesW ReadConsoleW FindFirstFileExW IsValidCodePage GetACP VerifyVersionInfoW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSection SetEnvironmentVariableW GetFullPathNameA

user32

CharNextW BringWindowToTop TranslateAcceleratorW GetClassNameW SetCapture GetDlgItem GetParent RegisterWindowMessageW ReleaseCapture SetForegroundWindow InvalidateRect GetForegroundWindow GetSysColor AttachThreadInput IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow InvalidateRgn IsWindow SetFocus ScreenToClient FillRect GetFocus GetWindow IsIconic BeginPaint EndPaint GetWindowTextW GetSystemMetrics GetMessageW DefWindowProcW GetWindowLongW DestroyWindow SetWindowPos CreateWindowExW SendMessageW RegisterClassExW GetActiveWindow DispatchMessageW CreateAcceleratorTableW SetWindowTextW CallWindowProcW GetWindowTextLengthW GetWindowThreadProcessId wsprintfW PostThreadMessageW TranslateMessage LoadCursorW SetWindowLongW PostQuitMessage GetDesktopWindow GetClassInfoExW GetDC MessageBoxW ShowWindow GetAsyncKeyState ReleaseDC PostMessageW UnregisterClassW GetClientRect EnumWindows MoveWindow GetShellWindow LoadImageW SystemParametersInfoW EnableMenuItem LoadIconW GetSystemMenu GetClassLongW AppendMenuW SetClassLongW GetWindowRect

gdi32

DeleteDC GetObjectW DeleteObject CreateSolidBrush GetDeviceCaps SelectObject CreateCompatibleBitmap GetStockObject BitBlt CreateCompatibleDC

advapi32

SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW GetTokenInformation CreateWellKnownSid LookupPrivilegeValueW OpenProcessToken RegFlushKey RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegSetValueExW LookupAccountSidW RegOpenKeyExW RegEnumValueW EqualSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW GetUserNameW CredWriteW CredReadW CredDeleteW CredFree CredEnumerateW AdjustTokenPrivileges

ole32

CoCreateGuid CoAddRefServerProcess OleRun CoUninitialize CoInitialize CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoGetClassObject CoCreateInstance StringFromGUID2 OleInitialize OleUninitialize OleLockRunning CoTaskMemAlloc CoTaskMemFree CoReleaseServerProcess

oleaut32

VariantChangeType SysAllocStringLen SysStringLen SysFreeString VariantInit SysAllocString OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysAllocStringByteLen VariantCopy SysStringByteLen DispCallFunc GetErrorInfo VariantClear

bcrypt

BCryptCloseAlgorithmProvider BCryptVerifySignature BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptGetProperty

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW CryptProtectData CryptUnprotectData CryptStringToBinaryW CertOpenStore CertFindCertificateInStore CertFreeCertificateContext CertCreateCertificateContext CryptHashCertificate2 CryptImportPublicKeyInfoEx2 CertVerifySubjectCertificateContext CertAddCertificateContextToStore CertCloseStore

secur32

GetUserNameExW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain