2724bc400c8a0eb9d19689edbd9e5d72[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

2724bc400c8a0eb9d19689edbd9e5d72.bin
Size

462KB
MD5

2724bc400c8a0eb9d19689edbd9e5d72
SHA1

0dc0f213a966a94ed2950a02d11a523f2d6fc09d
SHA256

33236e7506272f0e4c3f1d0a9c934e79dcdb1b0d5cb5c2e266b3c35ee135efd8
SHA512

26b42fd368e004a7083bff41600e72b04af7f15bdc82ee084f4ca0b3461ac42359090fdcb83d9a487b5e0862b3455b07790618aa747af078565dc64635f0a95e
SSDEEP

12288:OVNB7P/nL9UOez/WS/rVsAaJC28nJ3zAcp/HG:gb6TLWcr7P28nBzzp/m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2724bc400c8a0eb9d19689edbd9e5d72.bin

Files

2724bc400c8a0eb9d19689edbd9e5d72.bin
.exe windows:4 windows x86 arch:x86

e06956ab8dac8673d6723757344a9309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW

secur32

LsaFreeReturnBuffer
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaConnectUntrusted

advapi32

SystemFunction040
SystemFunction041
RevertToSelf
LogonUserW
ImpersonateLoggedOnUser

ole32

CoCreateInstance

ntdll

NtAddAtom
NtAllocateVirtualMemory

kernel32

FreeLibrary
DisableThreadLibraryCalls
InterlockedIncrement
SystemTimeToFileTime
GetSystemTime
FileTimeToLocalFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
FileTimeToSystemTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetTickCount
LocalFree
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
InitializeCriticalSection
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
CloseHandle
EnterCriticalSection
GetLastError
GetProcAddress
LoadLibraryW
GetACP
GetCurrentProcessId
FormatMessageW
LocalAlloc
FileTimeToDosDateTime
UnhandledExceptionFilter
LeaveCriticalSection
DosDateTimeToFileTime
CompareStringW

netapi32

NetUserChangePassword
NetUserSetInfo

msvcrt

_except_handler3
swscanf
wcslen
wcscmp
_wcsicmp
wcschr
malloc
wcstok
free
sprintf
_purecall
_wcsnicmp
wcscpy
wcscat
_adjust_fdiv
_initterm

adsldpc

LdapOpenObject
ReadServerSupportsIsADControl
ADsObject
FreeObjectInfo
GetDefaultServer
LdapModifyS
BuildLDAPPathFromADsPath2
ChangeSeparator
LdapCloseObject
LdapCompareExt
BuildADsPathFromLDAPPath
LdapReadAttributeFast
LdapValueFree

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e06956ab8dac8673d6723757344a9309

Headers

File Characteristics

Imports

user32

secur32

advapi32

ole32

ntdll

kernel32

netapi32

msvcrt

adsldpc

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 241KB - Virtual size: 241KB

.data Size: 22KB - Virtual size: 968KB

.rdata Size: 183KB - Virtual size: 182KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 241KB - Virtual size: 241KB

.data
Size: 22KB - Virtual size: 968KB

.rdata
Size: 183KB - Virtual size: 182KB

.reloc
Size: 512B - Virtual size: 20B