stage-0[.]bin[.]exe

General

Target
stage-0.bin.exe
Size 335KB
Sample241107-tdcdlavgkh
SHA256 b0968bdb6a175a38ec05efcf605ed61411d16e63e692bc0d7b8f1f747ce3b2e5
MD5 8b7d2590f1fb0dfd81b796f4b4723542
SHA1 b492d614f7749220b934127cdfc737426797890c
SHA512 5381413edddf5b7ed746fccf00560e0e326cf499b2149c2fe7fadca6511a6008d9ab6521c1bad1ab74c53765c27eed9c27a80879395597d22e2071b98dfd8f38
SSDEEP 3072:M4WBLuupGWmJT8kk4nhCvjzgQdeTDKnBmnMPbdyqJD2/OX3kaVw5OvRQ46+a:F4LgWC9k8Cvjz8TDKnBPb0wKWfvRQ4V
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage-0.bin.exe

File Explorer

stage-0.bin.exe

.exe 335KB

stage-0.bin.exe

IMPHASH b585adb193cc73047fae4142a994b352
SHA256 b0968bdb6a175a38ec05efcf605ed61411d16e63e692bc0d7b8f1f747ce3b2e5
MD5 8b7d2590f1fb0dfd81b796f4b4723542
SHA1 b492d614f7749220b934127cdfc737426797890c
SHA512 5381413edddf5b7ed746fccf00560e0e326cf499b2149c2fe7fadca6511a6008d9ab6521c1bad1ab74c53765c27eed9c27a80879395597d22e2071b98dfd8f38
SSDEEP 3072:M4WBLuupGWmJT8kk4nhCvjzgQdeTDKnBmnMPbdyqJD2/OX3kaVw5OvRQ46+a:F4LgWC9k8Cvjz8TDKnBPb0wKWfvRQ4V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\giroza\gok\didamufufenuse-kusoj.pdb

kernel32

InterlockedIncrement GetLogicalDriveStringsW AddConsoleAliasW GetModuleHandleW GetTickCount FindNextVolumeMountPointA TlsSetValue LoadLibraryW SetCommConfig AssignProcessToJobObject WriteConsoleW GetModuleFileNameW CreateJobObjectA InterlockedExchange GetLastError GetProcAddress VirtualAlloc SetVolumeLabelW SetComputerNameExA OpenMutexA OpenWaitableTimerW LocalAlloc MoveFileA GetNumberFormatW RemoveDirectoryW GlobalFindAtomW EnumResourceTypesW GetConsoleTitleW VirtualProtect GetFileAttributesExW GetCurrentProcessId UnregisterWaitEx DeleteFileA GetVolumeInformationW LoadLibraryA GetSystemDefaultLangID FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep ExitProcess GetStartupInfoW WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapFree TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA RaiseException HeapAlloc HeapReAlloc HeapSize RtlUnwind GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA CloseHandle

user32

GetMenu

gdi32

GetCharABCWidthsFloatW

winhttp

WinHttpSetOption

Sharing