02aa02aee2a6bd93a4a8f4941a0e6310[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
02aa02aee2a6bd93a4a8f4941a0e6310.bin
Size 2.9MB
Sample240614-bcpcnaydpe
SHA256 e60cedf3509684fa676ae97f1bb5dc89788e50f3290398b259cc3ce5ba336f64
MD5 ed11bb68f08ca4a6fc4a6404435e57b3
SHA1 feb1fc86740b8b1adfc61fbd8fa07f47dc91e184
SHA512 ea3c09b2dcb3db9396fc4d3a9206a6fa4ea66062151be7f14e96791f21102c51d6267f1651220a8e321866c0e1b0c975f5c26823d00d287a3343120769ff9df3
SSDEEP 49152:Grh+ysP2bEZ3/29G04NoZhSqMUMWrH7F64mHyP1YglbM3SWQSdZrr:GcPIEZ3/eR4NIhSdyW87raz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

File Explorer

02aa02aee2a6bd93a4a8f4941a0e6310.bin

.zip 2.9MB
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

.exe 3.0MB

02aa02aee2a6bd93a4a8f4941a0e6310.bin

SHA256 e60cedf3509684fa676ae97f1bb5dc89788e50f3290398b259cc3ce5ba336f64
MD5 ed11bb68f08ca4a6fc4a6404435e57b3
SHA1 feb1fc86740b8b1adfc61fbd8fa07f47dc91e184
SHA512 ea3c09b2dcb3db9396fc4d3a9206a6fa4ea66062151be7f14e96791f21102c51d6267f1651220a8e321866c0e1b0c975f5c26823d00d287a3343120769ff9df3
SSDEEP 49152:Grh+ysP2bEZ3/29G04NoZhSqMUMWrH7F64mHyP1YglbM3SWQSdZrr:GcPIEZ3/eR4NIhSdyW87raz
MD5 SHA1 SHA512 SSDEEP

Password

infected

01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

IMPHASH 4cfda23baf1e2e983ddfeca47a5c755a
SHA256 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
MD5 02aa02aee2a6bd93a4a8f4941a0e6310
SHA1 03287a15bfd67ff8c3340c0bae425ecaa37a929f
SHA512 8103b18a8957fb1cb1e0f6f00eb4c81a037151fc2cd89f13f530eb7ea3002d23cdad037fb39610c38c3a71029a6c7b767d7ce00ada4cbd37e9f6ba0ed9af0f0c
SSDEEP 49152:YKbiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyago:YKGWJ6sDYI2qPX4fgPZcUAUjSkXvDUin
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

120283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

comctl32

InitCommonControlsEx

shlwapi

SHAutoComplete

kernel32

FindClose FindNextFileW FindFirstFileW GetVersionExW GetCurrentDirectoryW GetFullPathNameW GetModuleFileNameW FindResourceW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcessId GetLocaleInfoW GetNumberFormatW SetEnvironmentVariableW ExpandEnvironmentStringsW WaitForSingleObject GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime GetExitCodeProcess GetTempPathW MoveFileExW UnmapViewOfFile Sleep MapViewOfFile GetCommandLineW CreateFileMappingW GetTickCount OpenFileMappingW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread GetProcessAffinityMask CreateEventW CreateSemaphoreW ReleaseSemaphore ResetEvent SetEvent SetThreadPriority SystemTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime LocalFileTimeToFileTime WideCharToMultiByte MultiByteToWideChar CompareStringW IsDBCSLeadByte SetFileTime SetFileAttributesW SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleHandleA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetModuleFileNameA ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetCommandLineA RaiseException GetFileAttributesW FlushFileBuffers ReadFile GetFileType SetEndOfFile SetFilePointer WriteFile GetStdHandle GetLongPathNameW GetShortPathNameW GlobalAlloc MoveFileW CreateFileW CreateDirectoryW DeviceIoControl RemoveDirectoryW DeleteFileW CreateHardLinkW GetCurrentProcess CloseHandle SetLastError GetLastError CreateFileA GetCPInfo GetSystemTimeAsFileTime HeapAlloc HeapReAlloc HeapFree RtlUnwind

user32

EnableWindow GetDlgItem ShowWindow SetWindowLongW GetDC ReleaseDC FindWindowExW GetParent MapWindowPoints CreateWindowExW UpdateWindow LoadCursorW RegisterClassExW DefWindowProcW DestroyWindow CopyRect IsWindow CharUpperW OemToCharBuffA LoadIconW LoadBitmapW PostMessageW GetSysColor SetForegroundWindow MessageBoxW WaitForInputIdle IsWindowVisible DialogBoxParamW DestroyIcon SetFocus GetClassNameW SendDlgItemMessageW EndDialog GetDlgItemTextW SetDlgItemTextW wvsprintfW SendMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadStringW GetWindowRect GetClientRect SetWindowPos GetWindowTextW SetWindowTextW GetSystemMetrics GetWindow GetWindowLongW

gdi32

GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject StretchBlt DeleteDC GetObjectW DeleteObject CreateDIBSection

comdlg32

GetSaveFileNameW CommDlgExtendedError GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

SHBrowseForFolderW ShellExecuteExW SHGetSpecialFolderLocation SHFileOperationW SHGetPathFromIDListW SHGetMalloc SHChangeNotify SHGetFileInfoW

ole32

CLSIDFromString CoCreateInstance OleInitialize OleUninitialize CreateStreamOnHGlobal

oleaut32

VariantInit