c05e22b288ae1ab8bb88f595d61dff5c[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

c05e22b288ae1ab8bb88f595d61dff5c.bin
Size

2.5MB
MD5

b398991d93af9768593817e791604190
SHA1

17534c9024005578c9bc29ea456f15b415afa075
SHA256

821441211cacebc6e8db18fc9f033520491bb15ae520d130fdc1f8f88badcb76
SHA512

8e72f1fde4b87c56272321d290bfa0f96f9a405a7a1ff68235394549b9054133b186ac4dc09884ce09c6614856c0a0bb7d78e731261ef54a3be357c777bb94d7
SSDEEP

49152:IbMJJn/fp/SxojcNt83prPqu9gA/hIYZcOA8BmL5zbvoa4YwiZxVwFRntUqd:IQJdR/Sxojcr8ZrP9yA/hSOA8Bm1zbwF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll

Files

c05e22b288ae1ab8bb88f595d61dff5c.bin
.zip

Password: infected
66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll
.dll windows:6 windows x86 arch:x86

Password: infected

9ab3baba5555f17df6a34cd9ca7333f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\proxy\target\release\deps\proxy.pdb

Imports

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetVolumeInformationA
CloseHandle
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
TlsGetValue
TlsSetValue
lstrlenW
AllocConsole
FormatMessageW
GetLastError
Sleep
CreateToolhelp32Snapshot
Module32First
Module32Next
GetModuleFileNameW
GlobalLock
GlobalSize
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GlobalUnlock
CreateFileW
WaitNamedPipeW
PeekNamedPipe
ReadFile
WriteFile
FlushFileBuffers
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
LoadLibraryExW
GetCurrentProcess
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
SleepConditionVariableSRW
SetHandleInformation
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
GetNativeSystemInfo
VirtualQuery
VirtualAlloc
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
GetCurrentThread
RtlCaptureContext
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
GetFinalPathNameByHandleW
CopyFileExW
GetConsoleMode
GetModuleHandleW
ExitProcess
GetFullPathNameW
WriteConsoleW
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTempPathW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent

ws2_32

WSASend
send
recv
getsockopt
getpeername
getsockname
ioctlsocket
connect
bind
WSASocketW
setsockopt
getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
socket
WSAGetLastError
closesocket
WSAIoctl

user32

GetWindowLongW
FindWindowExW
MessageBoxW
FlashWindowEx
OpenClipboard
GetClipboardData
CloseClipboard
GetForegroundWindow
GetWindowThreadProcessId
SetClipboardData
EmptyClipboard

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

crypt32

CryptProtectData
CryptUnprotectData

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

advapi32

RegDeleteKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
SystemFunction036
RegGetValueA

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtCancelIoFileEx
NtReadFile

vcruntime140

__CxxFrameHandler3
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
memset
memcmp
memmove
memcpy

api-ms-win-crt-math-l1-1-0

ceil
floor
roundf

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
strerror
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fgetc

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

DllMain
pcre_ca_export_2
pcre_compile
pcre_compile2_export_4
pcre_compile2_export_5
pcre_compile2_export_6
pcre_compile2_export_7
pcre_compile2_export_8
pcre_exec
pcre_free

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

9ab3baba5555f17df6a34cd9ca7333f0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

user32

shell32

ole32

crypt32

iphlpapi

bcrypt

advapi32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 82KB - Virtual size: 84KB

.reloc Size: 207KB - Virtual size: 207KB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 82KB - Virtual size: 84KB

.reloc
Size: 207KB - Virtual size: 207KB