deafbdc620c448f30ed765cea21bd8d4[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

deafbdc620c448f30ed765cea21bd8d4.bin
Size

723KB
MD5

d6ae9c1cc7f683b2310dd9dd250672e9
SHA1

43660d9b2a1b3efbce2840377c9c812d1c656331
SHA256

6cb85b32c5db6e588b61c7b7e29400c159c7cd1fc471c9d6a9c0eb2783fa9480
SHA512

1c8c9e4aa23e39e4c5515b19c36478ff56953186e3dbccd839134121772b08ac703909d3cd9a4dee7460e46751689ec479d6b0757d7fc3ff5ec2abb920bce849
SSDEEP

12288:l+l9T1vZzGZc61p2/dytMCNH1pnKcswkFcVqtHYzxh1v6XUn0kILwDplaaIwQrMJ:l+RSTpGdAMyjhswkF7YZ6kn0kl/aaIwv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d8558fe78f5016bde05a841d05d094bc7fe040b36f6d195ae33ece9fa4b0f9e6.exe

Files

deafbdc620c448f30ed765cea21bd8d4.bin
.zip

Password: infected
d8558fe78f5016bde05a841d05d094bc7fe040b36f6d195ae33ece9fa4b0f9e6.exe
.exe windows:6 windows x64 arch:x64

Password: infected

12e05564973f6ccadd3ed1ae3226f401

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strtoul
??2@YAPEAX_K@Z
rand
srand
??_V@YAXPEAX@Z
exit
??_U@YAPEAX_K@Z
_time64
free
strstr
toupper
memcpy
memset

kernel32

GetTickCount64
WideCharToMultiByte
LoadLibraryW
MultiByteToWideChar
GetFileAttributesW

Sections

.text
Size: 329KB - Virtual size: 329KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ