1ceeb0b14f71191a7d1a9d40e1174fc4[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

1ceeb0b14f71191a7d1a9d40e1174fc4.bin
Size

5.6MB
MD5

bcb02d95d426475d598b8f80196bda42
SHA1

bd60535fdd8ed24286e32c659a2b7398dd6a90de
SHA256

a787c179420603fa57097a242cf3ddd8ed175b392276cc0f089e1a8b76765ee6
SHA512

1be72c61b774fbdd0ea9db98ac0583ced6f8526334f5610a9c96cfaf5be9469cd2b1658ee611733bd49627492d6c1629c7a89915ef9897b11e73435929093431
SSDEEP

98304:LVFjEUfPiAKMMwHu0yOWK6cgW1xO6MCUEcdbnhv8+U7uhBQ:LHFKAcOgW1x94b6v4m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3046eb6a42d3384cdf7a663cd3537b03dcea72d334978fb4ab20afbfe3b1672b.exe

Files

1ceeb0b14f71191a7d1a9d40e1174fc4.bin
.zip

Password: infected
3046eb6a42d3384cdf7a663cd3537b03dcea72d334978fb4ab20afbfe3b1672b.exe
.exe windows:6 windows x86 arch:x86

Password: infected

4a1016ca782fc6652cdb42fa414cea03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableA
GetDiskFreeSpaceA
GetTempPathA
GetCurrentProcess
OpenProcess
GetModuleFileNameA
VerifyVersionInfoW
MultiByteToWideChar
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetFileTime
SystemTimeToFileTime
WriteConsoleW
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetProcessHeap
VerSetConditionMask
WriteFile
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
LCMapStringW
GetFileType
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
TlsFree
GetWindowsDirectoryA
GetSystemDirectoryA
CopyFileA
FindResourceA
SizeofResource
LockResource
LoadResource
FreeEnvironmentStringsW
GetLastError
SetFilePointer
ReadFile
GetFileSize
GetFileAttributesExA
CreateDirectoryA
CreateFileA
MoveFileExA
GetProcAddress
GetModuleHandleA
CreateProcessA
GetExitCodeProcess
TerminateProcess
DeleteFileA
Sleep
CloseHandle
RemoveDirectoryA
GetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
GetEnvironmentStringsW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
RaiseException
RtlUnwind
LocalFree
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

ShowWindow
CallWindowProcA
wsprintfA
SetProcessDPIAware
GetWindowThreadProcessId
GetClassNameA
EnumWindows
FindWindowExA
FindWindowA
DialogBoxParamA
MonitorFromWindow
SystemParametersInfoA
DrawIconEx
LoadImageA
EnumChildWindows
SetClassLongA
GetDlgItem
MessageBoxA
GetWindowTextA
SetWindowTextA
ReleaseDC
GetDC
SetForegroundWindow
EnableWindow
SendDlgItemMessageA
SetDlgItemTextA
EndDialog
CreateDialogParamA
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadStringA
SendMessageA
LoadCursorA
SetWindowLongA
GetWindowLongA
FillRect
DrawFocusRect
SetCursor
GetClientRect
InvalidateRect
EndPaint
BeginPaint
DrawTextA
GetFocus
SetFocus
GetDlgItemTextA

gdi32

DeleteObject
CreateSolidBrush
CreateFontA
CreateFontIndirectA
SetTextColor
SetBkMode
SelectObject
GetDeviceCaps

advapi32

ControlService
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
OpenProcessToken
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
LookupAccountSidW
FreeSid
AllocateAndInitializeSid

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
ord680
SHFileOperationA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderLocation
SHChangeNotify

ole32

CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

shlwapi

PathIsRelativeA
SHDeleteKeyA
PathIsNetworkPathA

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

4a1016ca782fc6652cdb42fa414cea03

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 146KB - Virtual size: 145KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 3KB - Virtual size: 14KB

.rsrc Size: 5.5MB - Virtual size: 5.5MB

.text
Size: 146KB - Virtual size: 145KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 3KB - Virtual size: 14KB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB