cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.bin
Size 2.2MB
Sample260601-x4b3asft2n
SHA256 cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2
MD5 3e2be260f9641ac2e01dab64f352d0b2
SHA1 1561bb1a17848a7995e8ea4b4d469d9de7c9b837
SHA512 4d3412945258c067b0c20ece52c2f9bda3745ae319946dc4ea6cb0873c9d893ca8f99aecb891ccc7a3d9536d71ef23a5849d92d7547970bfbaccbcaf06da42fe
SSDEEP 12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
TLSH
T184B5D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.bin

File Explorer

cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.bin

.dll 2.2MB

cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.bin

IMPHASH 6668be91e2c948b183827f040944057f
SHA256 cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2
MD5 3e2be260f9641ac2e01dab64f352d0b2
SHA1 1561bb1a17848a7995e8ea4b4d469d9de7c9b837
SHA512 4d3412945258c067b0c20ece52c2f9bda3745ae319946dc4ea6cb0873c9d893ca8f99aecb891ccc7a3d9536d71ef23a5849d92d7547970bfbaccbcaf06da42fe
SSDEEP 12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
TLSH
T184B5D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392604F9EF86546E3E9AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA AddSecurityPackageW ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CloseLsaPerformanceData CollectLsaPerformanceData CompleteAuthToken CredMarshalTargetInfo CredParseUserNameWithType CredUnmarshalTargetInfo DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext FreeContextBuffer FreeCredentialsHandle GetComputerObjectNameA GetComputerObjectNameW GetSecurityUserInfo GetUserNameExA GetUserNameExW ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification MakeSignature OpenLsaPerformanceData QueryContextAttributesA QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SeciAllocateAndSetCallFlags SeciAllocateAndSetIPAddress SeciFreeCallContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiExcludePackage SspiFreeAuthIdentity SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiUnmarshalAuthIdentity SspiValidateAuthIdentity SspiZeroAuthIdentity TranslateNameA TranslateNameW UnsealMessage VerifySignature

Name

.text

Size

260KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.qkm

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cvjb

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tlmkv

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wucsxe

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fltwtj

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sfplio

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rpg

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bewzc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vksvaw

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wmhg

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nfuu

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cqcgue

Size

4KB

Virtual Size

503B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edydzn

Size

4KB

Virtual Size

539B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ksrr

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hgeuh

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qiaak

Size

4KB

Virtual Size

262B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zynyht

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zqgts

Size

4KB

Virtual Size

730B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xleq

Size

4KB

Virtual Size

431B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.baeb

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kayib

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dektug

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hytg

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ykttlu

Size

4KB

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bnq

Size

4KB

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.yrdhtv

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rmgdk

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=483, id=204, productName=VS2012 UPD4 build 61030, version=61030,

count=354, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=443, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=483, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=80, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=256, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=161, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,

count=478, id=158, productName=VS2010 build 30319, version=30319,

count=475, id=201, productName=VS2012 UPD3 build 60610, version=60610,

count=389, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,

count=133, id=206, productName=VS2012 UPD2 build 60315, version=60315,

count=405, id=256, productName=VS2015 UPD1 build 23506, version=23506,

count=491, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=144, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=495, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=424, id=206, productName=VS2012 build 50727, version=50727,

count=171, id=222, productName=VS2013 UPD5 build 40629, version=40629,

count=194, id=147, productName=VS2008 build 21022, version=21022,

count=122, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

count=180, id=203, productName=VS2012 UPD1 build 51106, version=51106,

count=302, id=1, productName=Unmarked objects,

count=142, id=145, productName=VS2008 build 21022, version=21022,

count=58, id=257, productName=VS2015 [14.0] build 23026, version=23026,

cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.bin

user32

setupapi

kernel32

gdi32

crypt32

advapi32

shlwapi

generic