031377e4e34dcd19917fac02ff6da79f[.]bin | Triage

Sharing

General

Target

031377e4e34dcd19917fac02ff6da79f.bin
Size

9KB
MD5

7de31cce4ae17656714fc1443ab3ebb9
SHA1

94446a26abbfb9c03617c9da7df386d96bfac694
SHA256

e282d28d4ff002d55ea89e7c09786436fa91da058b72ca9787192a9bb23bf838
SHA512

e5cc10fa654e6017f6f3a5c66aac3727fafd884a724d2ac5b8a8cf237d4896ff11e61ec06501f0cc545fff8436fe0791f3bd70c868a20c52171f04e425209a22
SSDEEP

192:6XpRU4tXAYJTc+JsJCGI+BgxBVaI7yZ2qRbTzXr57LYxLrz+eRsnCHIBxvYjvFD:6XQmXtcQsIbaUix7LQYCHIXQD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d58061a43df6b63e97421904c066ed5ad4b87a3733c250e105e83bc7154d9414.exe

Files

031377e4e34dcd19917fac02ff6da79f.bin
.zip

Password: infected
d58061a43df6b63e97421904c066ed5ad4b87a3733c250e105e83bc7154d9414.exe
.exe windows:5 windows x64 arch:x64

Password: infected

d379cbaf0643853afc3c79c366e49af2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVolumeInformationW
GetWindowsDirectoryW
SetFileAttributesW
CreateDirectoryW
lstrcatW
DeleteFileW
GetModuleFileNameW
GetVersionExW
ReadFile
CloseHandle
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileW
LoadLibraryA
HeapFree
GetProcAddress

advapi32

RegSetValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ