bot_library[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

bot_library.7z
Size

1.2MB
MD5

4f861fe0639b647a77973bc81748ed50
SHA1

40a1502ac4952f226322727949916080ce55365b
SHA256

3ebc497a34633ed5816769ef7559f21625667e9d6597dcafea9c98d37dd47de2
SHA512

28ad22aa3b3a22201445c9fb1bf760be3cbadb05bf7451020ec7eb3d1e5f403f5be7da169451520d5f0bc175f67914603b1435ef608aa341be97129385129f64
SSDEEP

24576:OL3CSs9JsxzhIXyxRv4RCwiGXPB36R5+iLOgQIthN+x4OHLE:Ky39JqhK4t4R+GX0GlgXhQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bot_library.exe

Files

bot_library.7z
.7z

Password: infected
bot_library.exe
.exe windows:6 windows x64 arch:x64

Password: infected

0310d0b7a3c8a9b3a9a6000ff3663c2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

bot_library.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

kernel32

DuplicateHandle
HeapFree
HeapAlloc
GetProcessHeap
FormatMessageW
GetCurrentThreadId
SetFileTime
TerminateThread
WaitForSingleObject
CreateThread
SetHandleInformation
AllocConsole
ReleaseMutex
GetLastError
CreateMutexW
GetModuleFileNameW
GetSystemTimeAsFileTime
OpenThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
CreateIoCompletionPort
GetQueuedCompletionStatusEx
CreateProcessW
VirtualAlloc
LoadLibraryExA
ReadFile
GetOverlappedResult
PostQueuedCompletionStatus
VirtualFree
ExitProcess
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetConsoleWindow
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
GetExitCodeProcess
GetProcessId
QueryPerformanceFrequency
CloseHandle
HeapReAlloc
lstrlenW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
GetFinalPathNameByHandleW
CopyFileExW
CreateEventW
CancelIo
GetConsoleMode
GetModuleHandleW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA

ws2_32

ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
send
getsockopt
setsockopt
WSAIoctl
WSAGetLastError
socket
WSAStartup
shutdown
freeaddrinfo
WSASend
getaddrinfo
closesocket
recv
WSACleanup

user32

ShowWindow

advapi32

SystemFunction036
OpenProcessToken
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize

shell32

ShellExecuteExW

ntdll

NtReadFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtSetInformationThread
NtWriteFile
NtCreateFile

secur32

AcceptSecurityContext
EncryptMessage
ApplyControlToken
DecryptMessage
FreeContextBuffer
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW
InitializeSecurityContextW

crypt32

CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateStore
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateContext

bcrypt

BCryptGenRandom

oleaut32

SysStringLen
SysFreeString

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
memcmp
memmove
__CxxFrameHandler3
memcpy
memset

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_c_exit
_set_app_type
_cexit
exit
_seh_filter_exe
_exit
_crt_atexit
_configure_narrow_argv
__p___argc
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
__p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

0310d0b7a3c8a9b3a9a6000ff3663c2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ws2_32

user32

advapi32

ole32

shell32

ntdll

secur32

crypt32

bcrypt

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 147KB - Virtual size: 147KB

.reloc Size: 38KB - Virtual size: 38KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 147KB - Virtual size: 147KB

.reloc
Size: 38KB - Virtual size: 38KB