b8b79c32cb4cf49359e7fdbf6797e866[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

b8b79c32cb4cf49359e7fdbf6797e866.bin
Size

2.8MB
MD5

e73403f37f63d4a0c85ec95dc03f2a4f
SHA1

f49be73ec9a7fe5a266e9f2e696363b768fdb79d
SHA256

8bd5a33230632ca3a3c73ad59cac80df17198864f370bdb5da49d37a3282ffa2
SHA512

f21f7220b0a79f4c45c852ed95251e5890e2596fdfc083acc86c34e7a3762b4106758595a4e447f829c367c121cdebcd1db5eb1f21e4bd91615dad9319ac9c7b
SSDEEP

49152:gGdQGmnnLTBvflR9bYZkYaLg1KU3DuhUjPrXCMldl4Tbx32u82CBguceoQuDMHuC:gGHmnLFVnbEkYaLMX3DuUmX/2Bgue9Qj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/86f8ffe0eed54cbafe84b4b4bf7c9170957716b4e2b12e89efebbf7019165630.exe

Files

b8b79c32cb4cf49359e7fdbf6797e866.bin
.zip

Password: infected
86f8ffe0eed54cbafe84b4b4bf7c9170957716b4e2b12e89efebbf7019165630.exe
.exe windows:4 windows x86 arch:x86

Password: infected

21ff96141ac8e53cf47d650310c3562f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
setlocale
memcpy
memmove
malloc
free
pow
floor
rand
acos
cos
sin
ceil
wcslen
wcscpy
wcscmp
_wcsicmp
wcsncpy
wcscat
wcschr
fseek
fread
fclose
ftell
log10
_wfopen
memcmp
atoi
sprintf
strcpy
_stricmp
strlen
strcat
wcsstr
tolower
_CIpow
_CIcos
_CIsin
_CIfmod
_CIexp
_CItan
_isnan
_finite
longjmp
_setjmp3
strstr
_strnicmp
strcmp
strncpy
_wcsdup
wcsncmp
_wcsnicmp
swscanf
_snwprintf
localtime
mktime
_itow
_wtoi
gmtime
abs
sqrt
atan2
fmod
fabs
??3@YAXPAX@Z
??2@YAPAXI@Z
getenv
__p__iob
fprintf
realloc
_errno
calloc
fopen
toupper
log
ldexp
qsort
exp
atan
labs
exit
memchr
vfprintf
_open
_close
_wopen
_read
_lseeki64
_fstat
_write
strncmp
bsearch
_snprintf
_CIlog
_CIsqrt
_CIatan2
frexp
modf
strerror
abort
atof
fflush
fwrite
_vsnprintf
ferror
sscanf
_setmode
_fdopen
strchr
strtol
strtoul
strrchr
fputs
strpbrk
_access
fputc
fgets
strspn
strcspn
isupper
srand
__CxxFrameHandler
_stati64
time
_ftime
_setjmp
_lseek
_vsnwprintf
??1type_info@@UAE@XZ

kernel32

GetModuleHandleW
HeapCreate
GetCurrentProcessId
CloseHandle
HeapDestroy
ExitProcess
GetProcAddress
GetDiskFreeSpaceExW
TlsFree
CreateFileW
SetFilePointer
SetEndOfFile
TlsAlloc
TlsGetValue
TlsSetValue
FormatMessageW
LocalFree
GetLogicalDriveStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalLock
GlobalUnlock
GetWindowsDirectoryW
SetErrorMode
GetCurrentProcess
SetPriorityClass
WriteProfileStringW
GetProfileStringW
GetPrivateProfileStringW
MoveFileExW
GetFileSize
GlobalAlloc
ReadFile
GetVolumeInformationW
GetDriveTypeW
MultiByteToWideChar
GlobalFree
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
CreateMutexW
GetLastError
WaitForSingleObject
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationW
SetLastError
CreateNamedPipeW
FreeLibrary
GetShortPathNameW
LoadLibraryW
OpenProcess
HeapFree
HeapAlloc
HeapReAlloc
WriteFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
CreateThread
SuspendThread
ResumeThread
TerminateThread
LoadLibraryExW
Sleep
MulDiv
GetCurrentThreadId
GetCommandLineW
GetModuleFileNameW
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessW
PeekNamedPipe
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetExitCodeProcess
WideCharToMultiByte
SetUnhandledExceptionFilter
DeleteFileW
GlobalSize
GlobalReAlloc
GetDiskFreeSpaceW
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDrives
GetVersionExW
CompareFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventW
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
CopyFileW
SetFileAttributesW
MoveFileW
GetTempPathW
GetLongPathNameW
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CreateDirectoryW
RemoveDirectoryW
GetComputerNameW
GetProcessAffinityMask
GetLocalTime
HeapSize
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
ExpandEnvironmentStringsA
FormatMessageA
CreateFileA
GetFileSizeEx
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

LoadCursorW
GetSysColor
LoadIconW
SetForegroundWindow
ReleaseCapture
GetClientRect
ClientToScreen
PtInRect
ClipCursor
SetCapture
GetDlgCtrlID
SendMessageW
IsWindow
GetParent
ShowWindow
CreateWindowExW
SetWindowLongW
SetPropW
SetClassLongW
InvalidateRect
GetSystemMetrics
GetWindowLongW
GetAsyncKeyState
GetForegroundWindow
DestroyIcon
CallWindowProcW
FillRect
SetWindowPos
GetClassNameW
GetWindow
GetCursorPos
WindowFromPoint
MapWindowPoints
ChildWindowFromPoint
ScreenToClient
SetClipboardViewer
ChangeClipboardChain
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
UpdateWindow
SetFocus
GetDesktopWindow
GetDC
GetCursor
ReleaseDC
ShowCursor
CallNextHookEx
PostMessageW
EnableWindow
SetCursor
GetPropW
BeginPaint
EndPaint
SetWindowRgn
RemovePropW
SystemParametersInfoW
GetWindowRect
RedrawWindow
SetCursorPos
DestroyCursor
SetClipboardData
EnumPropsExW
IsWindowEnabled
DrawTextW
FindWindowW
FindWindowExW
GetFocus
InvertRect
RegisterHotKey
UnregisterHotKey
GetClassLongW
DestroyWindow
SetParent
CreateIconIndirect
GetKeyState
SendInput
SetScrollInfo
OffsetRect
IsRectEmpty
SubtractRect
LockWindowUpdate
FrameRect
InflateRect
EnumChildWindows
SetScrollPos
GetScrollPos
GetWindowTextW
DrawFocusRect
DrawFrameControl
EnumDisplaySettingsW
EmptyClipboard
ExitWindowsEx
GetDoubleClickTime
GetCapture
IsZoomed
IsIconic
GetIconInfo
DrawStateW
MoveWindow
MessageBoxW
DefWindowProcW
GetWindowTextLengthW
UnregisterClassW
RegisterClassExW
CreateAcceleratorTableW
BringWindowToTop
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetMenu
DestroyMenu
DrawIconEx
GetMenuItemCount
GetSubMenu
GetMenu
GetMenuItemInfoW
ModifyMenuW
SetMenuItemInfoW
GetSysColorBrush
CreateMenu
AppendMenuW
CreatePopupMenu
EnableMenuItem
TrackPopupMenu
GetActiveWindow
WinHelpW
IntersectRect
SetWindowTextW
SetRect
RegisterRawInputDevices
GetRawInputData
SetActiveWindow
SetTimer
RegisterClassW
AdjustWindowRectEx
PeekMessageW
MsgWaitForMultipleObjects
DefFrameProcW
IsChild
RegisterWindowMessageW
ValidateRect
SendDlgItemMessageW
GetDlgItemTextW
SetDlgItemTextW
EndDialog
CreateDialogParamW
GetUpdateRect
GetScrollInfo
GetWindowDC
GetMessagePos
ChildWindowFromPointEx
KillTimer
GetScrollRange
LoadStringW
EnumDisplayDevicesW
CopyImage
CreateIconFromResourceEx
CreateIconFromResource
CharUpperW
CharLowerW
PeekMessageA
DispatchMessageA

gdi32

SetBkMode
SetTextColor
SetBkColor
CreatePatternBrush
PlgBlt
GetDeviceCaps
CreateSolidBrush
GetObjectW
DeleteObject
SetDIBits
BitBlt
GetDIBits
GetTextMetricsW
StretchBlt
CreateCompatibleDC
SelectObject
DeleteDC
CreatePen
MoveToEx
LineTo
CreateCompatibleBitmap
CreateDIBSection
SetStretchBltMode
SetDeviceGammaRamp
SetDCBrushColor
GetStockObject
SetBrushOrgEx
SetDIBitsToDevice
GetPixel
CreateRoundRectRgn
CreateBitmap
GetMapMode
SetMapMode
GetObjectType
IntersectClipRect
CreateFontIndirectW
CreateDCW
StartDocW
StartPage
GetCurrentObject
GetTextAlign
GetTextColor
GetBkMode
GetBkColor
GetROP2
EndPage
SetTextAlign
SetROP2
EndDoc
SetPixel
GetTextExtentPoint32W
StretchDIBits
SelectPalette
RealizePalette
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
SelectClipRgn
CreateRectRgn
OffsetViewportOrgEx
SetViewportOrgEx
ExcludeClipRect
GdiGetBatchLimit
GdiSetBatchLimit
TextOutW
SetPixelV
Rectangle
Ellipse
ExtFloodFill
RoundRect
GetObjectA
CreateFontW

advapi32

RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetFileSecurityW
GetSecurityDescriptorOwner
IsValidSid
LookupAccountSidW
RegCreateKeyExW
GetCurrentHwProfileW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
GetUserNameW
SystemFunction036
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash

comctl32

ImageList_SetIconSize
ImageList_Create
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_DragMove
ImageList_EndDrag
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Add
CreateToolbarEx
ImageList_GetIconSize
CreateStatusWindowW
InitCommonControlsEx
ImageList_GetImageCount
ImageList_Duplicate
ImageList_SetBkColor
_TrackMouseEvent
ImageList_Replace
ImageList_Remove
ImageList_AddMasked

oleaut32

VariantClear
SysFreeString
VariantInit
VariantChangeType
DispGetParam
OleLoadPicture
SysAllocString
GetActiveObject
DispGetIDsOfNames
VariantCopy
OleCreatePropertyFrame
SysStringLen

shell32

DragAcceptFiles
Shell_NotifyIconW
DragQueryFileW
DragFinish
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetDesktopFolder
ShellExecuteExW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetFolderLocation

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoGetObject
CLSIDFromProgID
CoGetClassObject
CLSIDFromString
ProgIDFromCLSID
OleUninitialize
CoTaskMemFree
OleInitialize
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
DoDragDrop
GetHGlobalFromStream
OleCreate
OleSetContainedObject

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

ws2_32

closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
socket
recv
WSAGetLastError
send
ntohs
WSASetLastError
getsockopt
setsockopt
getpeername
getsockname
htons
bind
connect
WSAIoctl
select
__WSAFDIsSet
getaddrinfo
freeaddrinfo
htonl
listen
accept
ioctlsocket
ntohl

crypt32

CertFreeCertificateContext
CertOpenStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CryptQueryObject
CertAddCertificateContextToStore
CertGetNameStringA

winmm

PlaySoundW
mciSendStringW
mmioStringToFOURCCW
mciGetErrorStringW
mciSendCommandW
timeEndPeriod
timeBeginPeriod

shlwapi

PathFileExistsW

msimg32

AlphaBlend

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY
GdiplusStartup
GdipCreateFontFromDC
GdipCreateFromHDC
GdipCreatePath
GdipCreateMatrix
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipAlloc
GdipCloneBrush
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipGetStringFormatFlags
GdipScaleMatrix
GdipSetCompositingMode
GdipSetStringFormatFlags
GdipSetInterpolationMode
GdipSetPageUnit
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipTranslateWorldTransform
GdipStartPathFigure
GdipAddPathLine
GdipAddPathBezier
GdipClosePathFigure
GdipCreateTextureIA
GdipDisposeImageAttributes
GdipGetImageBounds
GdipScaleTextureTransform
GdipSetPenBrushFill
GdipSetTextureTransform
GdipSetTextureWrapMode
GdipVectorTransformMatrixPoints
GdipTranslateTextureTransform
GdipFillPath
GdipSetPathFillMode
GdipSetPenColor
GdipDrawPath
GdipSetPenDashStyle
GdipSetPenLineCap197819
GdipSetPenLineJoin
GdipSetPenWidth
GdipCreateFontFromLogfontA
GdipCreateFont
GdipDeleteFontFamily
GdipGetFamily
GdipGetFontSize
GdipGetFontStyle
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHICON
GdipCreateBitmapFromGdiDib
GdipCreateImageAttributes
GdipDisposeImage
GdipCloneImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipGetImageWidth
GdipImageRotateFlip
GdipSetImageAttributesColorMatrix
GdipInvertMatrix
GdipMultiplyMatrix
GdipSetMatrixElements
GdipTransformMatrixPoints
GdipResetPath

imagehlp

MakeSureDirectoryPathExists

urlmon

UrlMkSetSessionOption

uxtheme

SetWindowTheme

wininet

InternetOpenW
InternetOpenUrlW

atl

AtlAxGetHost
AtlAxWinInit
AtlAxCreateControl
AtlAxGetControl

qrcodelib

ord18
ord19

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
ChooseColorW
PrintDlgW

Sections

.code
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

'.text'
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

21ff96141ac8e53cf47d650310c3562f

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

shell32

ole32

winspool.drv

ws2_32

crypt32

winmm

shlwapi

msimg32

gdiplus

imagehlp

urlmon

uxtheme

wininet

atl

qrcodelib

comdlg32

Sections

.code Size: 2.5MB - Virtual size: 2.5MB

.text Size: 1.4MB - Virtual size: 1.4MB

'.text' Size: 512B - Virtual size: 21B

.rdata Size: 325KB - Virtual size: 325KB

.data Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 225KB - Virtual size: 224KB

.code
Size: 2.5MB - Virtual size: 2.5MB

.text
Size: 1.4MB - Virtual size: 1.4MB

'.text'
Size: 512B - Virtual size: 21B

.rdata
Size: 325KB - Virtual size: 325KB

.data
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 225KB - Virtual size: 224KB