e7d405eec8052898f4d2b0440a6b72c9[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e7d405eec8052898f4d2b0440a6b72c9.bin
Size

6KB
MD5

3f0958e662b9696dfc7f4ab0ac332a41
SHA1

e9dd7c8281a032d4b3d29205130150f256ed4d9d
SHA256

d8ff692e3640e626c9d7a64e4b708ba0286b0adeb25c17bf0dc41664094bd1dd
SHA512

9a8a3ee6581e316af71289e92a0a784a4a3712b3dbf14f73aafc86347876fd99f0b72956e5480389fdc86b5ef53aa7fa55e001a8a163ba3ee1f531a7125be1c8
SSDEEP

192:xjf6fjz/MERzeVhShzk7iB9SUQELd1nUqTAtywb:x+f//Xy3Ok7iPSUQcd1U0Atp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2.exe

Files

e7d405eec8052898f4d2b0440a6b72c9.bin
.zip

Password: infected
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2.exe
.exe windows:4 windows x86 arch:x86

Password: infected

cb60ac7199494c7116659f98e53675e9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowThreadProcessId
wsprintfA
UpdateWindow
TranslateMessage
ShowWindow
SendMessageA
RegisterClassA
LoadIconA
LoadCursorA
GetMessageA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
CreateWindowExA

kernel32

VirtualFree
VirtualAlloc
Sleep
SetUnhandledExceptionFilter
SetFilePointer
ResetEvent
GetTempPathA
GetSystemTime
GetModuleHandleA
GetModuleFileNameW
GetEnvironmentVariableW
GetCurrentProcessId
ExitProcess
CreateToolhelp32Snapshot
CreateThread
CreateMutexW
CreateFileA
CreateEventA
CreateDirectoryW
CopyFileW
CloseHandle
WriteFile

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE