mod_my_l[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mod_my_l.bin
Size 22KB
Sample260506-lp88psex4v
SHA256 7a8d7b846f26b7b00b3c03b7188e7ebfc4112093749023c63246d6b14b6d7f69
MD5 4e4588a91d599afdc558a31e82a54b1c
SHA1 ec8feeeaaddac7df1838af8f24f8dc8fe446ec06
SHA512 86d79a5977a456000db78c373c5eda340f1adc2cd8e0c8a91b9ca76c9c731b6d45705d53b8305208cac9d0fe4888d423304ad303b58671233741f2cf688b72d7
SSDEEP 384:O8M81ycmDlbwiBqZ0Gx2vUZWNFnnnFjtjacuVxM1e+:NMWycm94j88WNbjtjacu7MF
TLSH
T16CA2E80FA24394DCC81FC1789AE98277B5B1B91164A7671D27B0CA320F34DAA6F38B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mod_my_l.bin

File Explorer

mod_my_l.bin

.exe 22KB

mod_my_l.bin

IMPHASH da653b036f3daaaed2f1c91cd466ba46
SHA256 7a8d7b846f26b7b00b3c03b7188e7ebfc4112093749023c63246d6b14b6d7f69
MD5 4e4588a91d599afdc558a31e82a54b1c
SHA1 ec8feeeaaddac7df1838af8f24f8dc8fe446ec06
SHA512 86d79a5977a456000db78c373c5eda340f1adc2cd8e0c8a91b9ca76c9c731b6d45705d53b8305208cac9d0fe4888d423304ad303b58671233741f2cf688b72d7
SSDEEP 384:O8M81ycmDlbwiBqZ0Gx2vUZWNFnnnFjtjacuVxM1e+:NMWycm94j88WNbjtjacu7MF
TLSH
T16CA2E80FA24394DCC81FC1789AE98277B5B1B91164A7671D27B0CA320F34DAA6F38B55
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CreateRemoteThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetLastError GetStartupInfoA InitializeCriticalSection IsWow64Process LeaveCriticalSection OpenProcess Process32FirstW Process32NextW SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WriteProcessMemory

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv __p___wargv __p__acmdln _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite

api-ms-win-crt-string-l1-1-0

strlen strncmp wcscmp wcscpy wcslen _wcsicmp

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mod_my_l.bin

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

winhttp

generic