1d8ea40a41988b9c3db9eff5fce3abe5[.]bin

General

Target

1d8ea40a41988b9c3db9eff5fce3abe5.bin
Size

619KB
MD5

1d8ea40a41988b9c3db9eff5fce3abe5
SHA1

58efd5f3994a4c3a42590b1c24032b89c4ecedda
SHA256

0b465877a998a993a64a146c80beaea2adf8e854644709706c6173a853ec8dba
SHA512

680c02afaaa6a464b90f8e1add9be4230008ad34ff569171c95a27f9127c9f5b4d569bf73ed5829cd6385c0a9e6e6d8f2bd717e99966dae9f3449129715846f8
SSDEEP

12288:Y1kfgjdkA/+x8NfO3Menn/O1XxoAPKrVNKpHyR4NBnpNhi3BSv2:zgjT/+x8NAMwnGBxoVxNuH3uI2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d8ea40a41988b9c3db9eff5fce3abe5.bin

Files

1d8ea40a41988b9c3db9eff5fce3abe5.bin
.exe windows:6 windows x86 arch:x86

e2c204b7897728cad8f72e10c1c6b97b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
CopyFileW
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
GetModuleHandleW
CloseHandle
ResumeThread
TerminateProcess
QueueUserAPC
UnmapViewOfFile
MapViewOfFile
DuplicateHandle
GetCurrentProcess
OpenProcess
GetCurrentProcessId
CreateProcessW
VirtualProtect
GetModuleHandleA
ExitProcess
FlushFileBuffers
WriteFile
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
WaitForSingleObject
WriteProcessMemory
SetThreadContext
GetThreadContext
GlobalAlloc
GlobalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

user32

TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
DispatchMessageW
PostQuitMessage
EndPaint
BeginPaint
DialogBoxParamW
DestroyWindow
DefWindowProcW
LoadIconW
LoadCursorW
CreateWindowExW
ShowWindow
UpdateWindow
EndDialog
RegisterClassExW

msvcrt

__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
memset
_stricmp
_vsnwprintf

ntdll

NtContinue
RtlUnwind

shell32

ShellExecuteW
ShellExecuteExW

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 606KB - Virtual size: 606KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2c204b7897728cad8f72e10c1c6b97b

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

ntdll

shell32

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 606KB - Virtual size: 606KB

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 606KB - Virtual size: 606KB