02bb63e3838307c0a3f20c84089b2055[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

02bb63e3838307c0a3f20c84089b2055.bin
Size

265KB
MD5

84f60a243b30572dbcf95e3227091663
SHA1

c3f156de8d926448321e7bed25ad2e9d8898d4fb
SHA256

86b7e5931ca5e90b92600d94bb1704645e31796c0189bb7fe3a60eeae344ce73
SHA512

2152df85e1aa420ecaaa00856bdde077a3064efb52bbe0b9275d008d805270066cc01849fedb909c62fe0583b14a6b9bc91c095dddeeea320c26f44fd8d04344
SSDEEP

6144:E+X+kjf5UsicTagIcFuG026gZc5ExnXWmHThbkFnpXekj:fR1UDCagnh16gdfNIrXew

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6.exe

Files

02bb63e3838307c0a3f20c84089b2055.bin
.zip

Password: infected
1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6.exe
.exe windows:6 windows x86 arch:x86

Password: infected

b0f2f9bb3d3701934ffc4c4f3d9b444c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Clive\source\repos\x86_driver\Release\x86.pdb

Imports

shlwapi

PathFileExistsA

advapi32

RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
RegFlushKey
RegCreateKeyExW

user32

SendMessageA
SetWindowPos
GetSystemMetrics
wsprintfA
PostThreadMessageA
GetWindowRect
MessageBoxA
GetParent
FindWindowA
FindWindowExA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetWindowThreadProcessId
GetTopWindow
EnumWindows

ntdll

RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlUnwind
NtLoadDriver
NtQuerySystemInformation

kernel32

LeaveCriticalSection
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCurrentDirectoryW
DeleteFileW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetCurrentDirectoryA
CreateFileA
CreateFileW
GetFileSize
ReadFile
WriteFile
DecodePointer
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryA
LoadLibraryW
lstrcmpiA
lstrcpyA
lstrcatA
lstrlenA
GetLogicalDriveStringsA
FindResourceA
GetPrivateProfileStringA
WritePrivateProfileStringA
QueryDosDeviceA
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetProcessImageFileNameA
EnterCriticalSection
WriteConsoleW
EncodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess

shell32

ShellExecuteA

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenA

urlmon

URLDownloadToFileA

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

b0f2f9bb3d3701934ffc4c4f3d9b444c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

advapi32

user32

ntdll

kernel32

shell32

wininet

urlmon

Sections

.text Size: 265KB - Virtual size: 265KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 6KB - Virtual size: 107KB

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 265KB - Virtual size: 265KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 6KB - Virtual size: 107KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 13KB - Virtual size: 12KB