c75e1e60d7b478e83c6fbe030d6de259[.]bin

General

Target

c75e1e60d7b478e83c6fbe030d6de259.bin
Size

4KB
MD5

78747e7a652dcc142365b9a0905d62ee
SHA1

595f578c4738b7e8e43e70cd692e3953665306d5
SHA256

50a185d8990811cd2c1bc26f2b2f2bd3db14be7016d4635aa4fb1af6150f71b6
SHA512

91dae61adaf62e0fb5d96e8640a02b2107f9a2bf81d87fee59af41a41f7dcdd120c3226775c602533bd00df63da3f62d1f0f1762775529a246444628a82aebdc
SSDEEP

96:S5Wz3ekKUSeb+jtj2GuhGx0gDKwTAyNXin2JSpdQigolBKhh+2u0PV:CWjekMA+wGRTDKwT3NgJQigoDKO6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5700f0bb61504e2b5385b23e4a8b1b427c78ae0444179aba7d5ce1b038be1be6.exe

Files

c75e1e60d7b478e83c6fbe030d6de259.bin
.zip

Password: infected
5700f0bb61504e2b5385b23e4a8b1b427c78ae0444179aba7d5ce1b038be1be6.exe
.exe windows:4 windows x64 arch:x64

Password: infected

f50efbaf45d94378e6cb1a2e2e5c8f5a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memset
printf
memcpy
memmove
rand
wcslen
strcmp
srand
strtol
_wsystem
_vsnprintf
_vsnwprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

kernel32

FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapSize
HeapReAlloc
CreateFileW
GetLastError
Sleep
WriteFile
HeapFree
CloseHandle
SleepEx
GetCommandLineW
ExpandEnvironmentStringsW

ntdll

NtQuerySystemInformation
RtlGetNtVersionNumbers

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle

bcrypt

BCryptEnumContexts
BCryptFinalizeKeyPair
BCryptGenerateKeyPair
BCryptGenRandom
BCryptHashData
BCryptQueryContextConfiguration
BCryptRegisterConfigChangeNotify
BCryptRemoveContextFunction

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f50efbaf45d94378e6cb1a2e2e5c8f5a

Headers

File Characteristics

Imports

msvcrt

kernel32

ntdll

winhttp

bcrypt

Sections

.text Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 192B

.text
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 192B