Trojan[.]Bladabindi[.]zip | Triage

Sharing

General

Target

Trojan.Bladabindi.zip
Size

38KB
MD5

434254111fbe2b2a287aed9211375384
SHA1

5bd255c6792fab7462e71cd42dc738bb18dc3f56
SHA256

8057f113df215814bffa638f50c5b4a45668a8c5399eaa584882b3afdab7d706
SHA512

65f49ea34cdea207a31e08beaa69b2513ae1b2554186654588d8dd0939c29a6953b46b1b71a96b90f698703c4c1a2ba6d872f2564d695c858dd7d4aa2cbd26f4
SSDEEP

768:XOm8NQHsUTJOjYRbdooLlcf7kj3ocMSQtVRUpHvuBBtXClNjcpULcXneCfxn5IEa:XORqMUTI+dokcj31Bt8CfxnCE8Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/hostr.exe

Files

Trojan.Bladabindi.zip
.zip

Password: infected
hostr.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ