2a270773553cfdca5c1fdbf24d44f18c[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

2a270773553cfdca5c1fdbf24d44f18c.bin
Size

112KB
MD5

d1d744eca0b19cf2a35b15beb7aaf00f
SHA1

4149ec11156f19fca7e9ed039a1117b637916611
SHA256

671025c054bcb5a68da47e033df4679ed2d1511cfa103b8043a9c18e6e97c2c2
SHA512

7dbc38552bffc925cfc12a65f4c8a07684ceeedce223523bfe11f843274e18912514f3508a7376efcbaf55a57c39cd88a9c97b84f0b91433f888dbbbe058e592
SSDEEP

1536:W2rxWFCAn2GxdFoKedtP0XJg7Rh43q6X62deEITDv4uCdVtVD6WBNub7SqqJOuuA:/9cCAPdNedWXMyjtQEgUJdBDrK1nTc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3ffb13f7f47722571dc7271ebbb09c2b893d4efe9a515f19fccc5e75cfa93220.exe

Files

2a270773553cfdca5c1fdbf24d44f18c.bin
.zip

Password: infected
3ffb13f7f47722571dc7271ebbb09c2b893d4efe9a515f19fccc5e75cfa93220.exe
.exe windows:5 windows x86 arch:x86

Password: infected

aeda2247107ce1cc9c58b0f6c2e9c5f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetDefaultCommConfigA
SetLocaleInfoA
DeleteVolumeMountPointA
InterlockedDecrement
GetEnvironmentStringsW
GetComputerNameW
GetModuleHandleW
GetDateFormatA
LoadLibraryW
ReadProcessMemory
GetTimeFormatW
GetConsoleAliasW
CreateProcessA
GetAtomNameW
GetStartupInfoW
GetShortPathNameA
SetLastError
GetProcAddress
PulseEvent
SetFileAttributesA
BuildCommDCBW
GetNumaHighestNodeNumber
LoadLibraryA
UnhandledExceptionFilter
InterlockedExchangeAdd
LocalAlloc
AddAtomA
FoldStringW
OpenFileMappingW
RequestWakeupLatency
WriteConsoleOutputAttribute
FindFirstVolumeA
FindAtomW
UnregisterWaitEx
CreateFileA
WriteConsoleW
SearchPathA
GetCommandLineW
MultiByteToWideChar
GetLastError
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
CloseHandle
WriteConsoleA
GetConsoleOutputCP
GetModuleHandleA

user32

GetClassLongW

gdi32

GetBitmapBits

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

aeda2247107ce1cc9c58b0f6c2e9c5f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 28KB - Virtual size: 3.9MB

.rsrc Size: 58KB - Virtual size: 57KB

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 28KB - Virtual size: 3.9MB

.rsrc
Size: 58KB - Virtual size: 57KB