6e170660d68b9e79601da0e6477e6930[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

6e170660d68b9e79601da0e6477e6930.bin
Size

11.6MB
MD5

ee3dfcaeca127e64093dc59a01a19eb3
SHA1

76e7af0b0053a1935135268aed8a9590c6b28089
SHA256

22646a31c60761630c4c972f79256369da543733a97295f88726f70c4d593e96
SHA512

ffba1ee22849e074baf65b82fe38e30e1ee0febec3d148605b6272acfc5407f3ba41a3e2634dab020bbb7c9f7e1eebbb1726cac1f1d124f6719ba7f3fb1858e9
SSDEEP

196608:8DT9TOBzlO0Z7HvVnugpQkb/lTMlmM9BYqlzZ0a+RdClwZ0SoARX4bi:8/9TOBt7PVnuo6lmopZ0bEKZBtRI+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fc993cf9a2b69cc48dbb9d8e3da898e6e49b531c441eb1ce7ca0b3c1f4151a14.exe

Files

6e170660d68b9e79601da0e6477e6930.bin
.zip

Password: infected
fc993cf9a2b69cc48dbb9d8e3da898e6e49b531c441eb1ce7ca0b3c1f4151a14.exe
.exe windows:6 windows x86 arch:x86

Password: infected

affad70c08099832efd72ee89040dc98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dwmapi

DwmGetWindowAttribute
DwmEnableBlurBehindWindow
DwmSetWindowAttribute

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey
ImmGetCompositionStringW
ImmNotifyIME
ImmReleaseContext
ImmAssociateContextEx
ImmGetDefaultIMEWnd
ImmGetContext
ImmGetOpenStatus
ImmAssociateContext

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiOpenDeviceInterfaceW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness
GetDpiForMonitor
GetProcessDpiAwareness

comdlg32

GetSaveFileNameW
GetOpenFileNameW

crypt32

PFXImportCertStore
CertFindChainInStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenSystemStoreW
CertVerifyTimeValidity
CertAddStoreToCollection
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey

d3d9

Direct3DCreate9Ex
Direct3DCreate9

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

dcomp

DCompositionCreateDevice

dwrite

DWriteCreateFactory

iphlpapi

ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW
GetAdaptersAddresses

secur32

InitSecurityInterfaceW
DecryptMessage
QueryContextAttributesW
EncryptMessage
DeleteSecurityContext
AcceptSecurityContext
AcquireCredentialsHandleW
FreeCredentialsHandle
ApplyControlToken
InitializeSecurityContextW
FreeContextBuffer

winhttp

WinHttpGetProxyForUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

userenv

GetUserProfileDirectoryW

advapi32

OpenProcessToken
SystemFunction036
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
RegNotifyChangeKeyValue
GetUserNameW
LookupAccountNameW
RegSetValueExW
RegOpenKeyExW
RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetNamedSecurityInfoW
LookupAccountSidW
CopySid
AllocateAndInitializeSid
AddAccessAllowedAceEx
AddAccessDeniedAceEx
SetSecurityDescriptorOwner

authz

AuthzFreeContext
AuthzAccessCheck
AuthzInitializeResourceManager
AuthzFreeResourceManager
AuthzInitializeContextFromToken
AuthzInitializeContextFromSid

kernel32

GetConsoleMode
SetFileAttributesW
SetStdHandle
FreeLibraryAndExitThread
ExitThread
GetConsoleOutputCP
ExitProcess
CompareStringEx
GetCommandLineW
GetCurrentProcessId
LocalFree
AllocConsole
FreeConsole
AttachConsole
OutputDebugStringW
GetConsoleWindow
GetLastError
CloseHandle
DuplicateHandle
SetEvent
WaitForSingleObject
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
MultiByteToWideChar
GetStdHandle
GetACP
TerminateProcess
IsProcessorFeaturePresent
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
GetLocalTime
LocalAlloc
FormatMessageW
CreateFileW
FlushFileBuffers
GetDriveTypeW
GetFileType
GetLogicalDrives
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
SetErrorMode
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
IsDebuggerPresent
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetLongPathNameW
RemoveDirectoryW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileInformationByHandleEx
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryW
GetCommandLineA
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
ResetEvent
WaitForSingleObjectEx
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
PeekNamedPipe
GetOverlappedResult
CancelIoEx
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
FindFirstFileExW
FindNextFileW
GetCurrentPackageFullName
GetComputerNameExW
GetExitCodeProcess
OpenProcess
K32GetModuleFileNameExW
GetFileSizeEx
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
CreateProcessW
LoadLibraryA
GetExitCodeThread
MulDiv
VirtualQuery
VirtualAlloc
VirtualProtect
VirtualFree
GetUserDefaultLocaleName
GetUserDefaultLangID
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DisconnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjectsEx
GlobalFree
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
CreateMutexW
ReleaseMutex
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
RaiseException
GetSystemTimeAsFileTime
ReadConsoleW
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetModuleHandleW
GetStartupInfoW
FindFirstFileW
WideCharToMultiByte
GetEnvironmentStringsW
HeapFree
HeapReAlloc
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
SetEnvironmentVariableW
IsValidCodePage
GetOEMCP
HeapAlloc
GetSystemDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW

netapi32

NetApiBufferFree
NetShareEnum

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

WSAHtonl
closesocket
WSAConnect
WSAAccept
WSAGetLastError
setsockopt
select
listen
htons
getpeername
bind
__WSAFDIsSet
getsockopt
getnameinfo
WSAIoctl
WSANtohl
WSANtohs
WSARecv
freeaddrinfo
getaddrinfo
WSASocketW
WSASendTo
WSASend
WSARecvFrom
WSAAsyncSelect
ntohl
htonl
WSACleanup
WSAStartup
getsockname

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

Shell_NotifyIconW
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
Shell_NotifyIconGetRect
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHGetKnownFolderPath
SHCreateItemFromParsingName
CommandLineToArgvW
SHGetPropertyStoreFromParsingName
SHParseDisplayName
SHGetMalloc
ord155

ole32

CoTaskMemAlloc
PropVariantClear
CoInitialize
CoGetMalloc
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
OleSetClipboard
PropVariantCopy
RegisterDragDrop
CoLockObjectExternal
ReleaseStgMedium
OleUninitialize
OleInitialize
CoInitializeEx
CoUninitialize
CoCreateGuid
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoIncrementMTAUsage
RevokeDragDrop
CoCreateFreeThreadedMarshaler

oleaut32

SafeArrayCreateVector
SafeArrayPutElement
VariantClear
VariantInit
SysFreeString
SysAllocString

mf

MFCreateDeviceSource
MFCreateAggregateSource
MFCreateAudioRenderer
MFCreateSampleGrabberSinkActivate
MFCreateTopoLoader
MFCreateAudioRendererActivate
MFCreateTopologyNode
MFCreateTopology
MFCreateMediaSession
MFGetService
MFCreateVideoRendererActivate
MFEnumDeviceSources

mfplat

MFCreateAttributes
MFStartup
MFTEnumEx
MFCreateMediaType
MFCreateSourceResolver
MFGetStrideForBitmapInfoHeader
MFCreateCollection
MFPutWorkItem
MFAllocateWorkQueue
MFUnlockWorkQueue
MFCreateAsyncResult
MFInvokeCallback
MFCreateEventQueue
MFFrameRateToAverageTimePerFrame
MFShutdown

propsys

PSCoerceToCanonicalValue
InitPropVariantFromFileTime

dxva2

DXVA2CreateDirect3DDeviceManager9

evr

MFCreateVideoSampleFromSurface

gdi32

BitBlt
ChoosePixelFormat
SetPixelFormat
CombineRgn
CreateRectRgn
DeleteObject
OffsetRgn
SetLayout
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
CreateBitmap
DescribePixelFormat
GetPixelFormat
SwapBuffers
GetBitmapBits
GetObjectW
GetDIBits
CreateDIBSection
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
GdiFlush
GetStockObject
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharWidthI
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDeviceCaps

mfreadwrite

MFCreateSinkWriterFromMediaSink
MFCreateSinkWriterFromURL
MFCreateSourceReaderFromMediaSource

shlwapi

AssocQueryStringW

user32

GetPointerDeviceRects
SkipPointerFrameMessages
GetPointerPenInfoHistory
GetShellWindow
GetPointerFrameTouchInfoHistory
GetPointerFrameTouchInfo
GetPointerType
CloseTouchInputHandle
GetTouchInputInfo
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
PostThreadMessageW
MsgWaitForMultipleObjects
MessageBoxW
DrawIconEx
ChangeWindowMessageFilterEx
GetPointerPenInfo
CharNextExA
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
RegisterClassW
UnregisterClassW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
SetCoalescableTimer
KillTimer
GetWindowLongW
SetWindowLongW
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
GetDesktopWindow
DestroyIcon
SystemParametersInfoW
UpdateLayeredWindowIndirect
GetKeyboardLayoutList
RegisterWindowMessageW
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
GetClassInfoW
RegisterClassExW
SetWindowPos
GetWindowPlacement
IsZoomed
GetFocus
GetSystemMetrics
GetDC
ReleaseDC
InvalidateRect
GetClientRect
GetCursorPos
ClientToScreen
ScreenToClient
WindowFromPoint
ChildWindowFromPointEx
GetParent
LoadImageW
SystemParametersInfoForDpi
GetThreadDpiAwarenessContext
GetWindowDpiAwarenessContext
GetAwarenessFromDpiAwarenessContext
AreDpiAwarenessContextsEqual
EnableNonClientDpiScaling
SetProcessDpiAwarenessContext
ChangeWindowMessageFilter
RegisterClipboardFormatW
GetClipboardFormatNameW
EnumDisplayDevicesW
SendMessageW
AttachThreadInput
IsChild
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
IsTouchWindow
GetCapture
SetCapture
ReleaseCapture
GetSystemMetricsForDpi
GetMenu
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
GetUpdateRect
SetWindowRgn
SetWindowTextW
GetWindowRect
AdjustWindowRectEx
AdjustWindowRectExForDpi
SetCursor
SetParent
GetWindowThreadProcessId
GetWindow
DestroyCursor
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
GetDpiForWindow
GetAncestor
GetSysColor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
AddClipboardFormatListener
RemoveClipboardFormatListener
SetMenu
DrawMenuBar
CreateMenu
CreatePopupMenu
DestroyMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
EnumDisplayMonitors
SetDisplayAutoRotationPreferences
GetMessageW
SendInput
GetPointerInfo
GetKeyboardLayout
IsWindowEnabled
CreateCaret
DestroyCaret
ShowCaret
SetCaretPos
FindWindowA
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
HiliteMenuItem
TrackPopupMenuEx
SetMenuDefaultItem
SetCursorPos
GetCursor
LoadCursorW

winmm

waveInOpen
waveOutGetNumDevs
waveInGetDevCapsW
waveOutOpen
waveOutGetDevCapsW
waveInMessage
waveInGetNumDevs
waveOutMessage
timeEndPeriod
timeBeginPeriod
timeSetEvent
timeKillEvent
PlaySoundW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Exports

Exports

qt_qmlDebugClearBuffer
qt_qmlDebugConnectionBlocker
qt_qmlDebugConnectorOpen
qt_qmlDebugDisableService
qt_qmlDebugEnableService
qt_qmlDebugMessageAvailable
qt_qmlDebugMessageBuffer
qt_qmlDebugMessageLength
qt_qmlDebugObjectAvailable
qt_qmlDebugSendDataToService
qt_qmlDebugSetStreamVersion
qt_startup_hook

Sections

.text
Size: 14.6MB - Virtual size: 14.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmimed
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 545KB - Virtual size: 545KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

affad70c08099832efd72ee89040dc98

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

imm32

setupapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

comdlg32

crypt32

bcrypt

d3d9

d3d11

dxgi

dcomp

dwrite

iphlpapi

secur32

winhttp

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

version

ws2_32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

shell32

ole32

oleaut32

mf

mfplat

propsys

dxva2

evr

gdi32

mfreadwrite

shlwapi

user32

winmm

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Exports

Exports

Sections

.text Size: 14.6MB - Virtual size: 14.6MB

.rdata Size: 5.7MB - Virtual size: 5.7MB

.data Size: 2.2MB - Virtual size: 2.2MB

.qtmimed Size: 332KB - Virtual size: 331KB

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 545KB - Virtual size: 545KB

.text
Size: 14.6MB - Virtual size: 14.6MB

.rdata
Size: 5.7MB - Virtual size: 5.7MB

.data
Size: 2.2MB - Virtual size: 2.2MB

.qtmimed
Size: 332KB - Virtual size: 331KB

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 545KB - Virtual size: 545KB